GitList < 0.6.0 Remote Code Execution

klaussilveira GitList version = 0.6 contains a passing incorrectly sanitized input via the searchTree function that can result in remote code execution. id: CVE-2018-1000533 info: name: GitList 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList...

vulhub

Vulhub는 사전 구축된, 바로 사용 가능한 취약한 Docker 환경의 오픈소스 모음입니다. 단 하나의 명령어로 보안 연구, 학습 또는 데모를 위한 취약한 환경을 실행할 수 있으며, Docker 경험이 필요하지 않습니다. 中文版本Chinese version 빠른 시작 Docker 설치 Ubuntu 24.04 예시: 최신 버전 docker 설치 curl -s https://get.docker.com/ | sh docker 서비스 실행 systemctl start docker 다른 운영 체제는 Docker 문서를 참조하세요. 모...

POC_CVE-2023-21839

CVE-2023-21839 特別な要件に基づき、@4ra1n 氏のGO版をPythonに移植しました。この場を借りて感謝申し上げます！ 免責事項 本プログラムは、許可されたセキュリティテストおよび研究目的にのみ使用されるべきです。利用者はサイバーセキュリティ法に従い、適切に使用してください。 本ツールを使用して不正な攻撃などの違法行為が発生した場合、作者は一切の責任を負いません。 使用方法 vulhub 再現：リンク / /\ //\ | \ / \ | / | / | // \ / / \ \ / /\ | | | | | | \ | |/ \ | \ | / / \ V...

CVE-2018-20062

CVE-2018-20062 thinkphp 5.0.23 vulhub thinkphp 脆弱性に対応 私は未熟すぎるので、今後ゆっくりと最適化していきます。先輩方、どうかお手柔らかにお願いします。...

CVE-2025-24813-vulhub

CVE-2025-24813-vulhub CVE-2025-24813のvulhub環境向けPOCスクリプト この脆弱性の悪用に戸惑っている仲間が多いため、vulhubでの脆弱性悪用を支援するスクリプトを書きました。 詳細はこちら：vulhub/tomcat/CVE-2025-24813...

Apache Solr DataImportHandler <8.2.0 - Remote Code Execution

Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug...

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Ruby On Rails - Local File Inclusion

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...

PhpMyAdmin Scripts - Remote Code Execution

PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...

ElasticSearch v1.1.1/1.2 RCE

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

Cve-2023-28432-

Cve-2023-28432 vulhubの再現プロセスを通じて、基本的なバッチ検出を実現しました。あまり良くないですが、なんとか使えます。vulhubリンク（https://github.com/vulhub/vulhub/tree/master/minio/CVE-2023-28432） 使用説明 新しく tagerts.txt を作成し、minIO APIポートのリンクを記入してください。プログラムをそのまま実行してください。結果はresult.txtに出力されます。...

Apache APISIX - Insufficiently Protected Credentials

Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. id: CVE-2020-13945 info: name: Apache...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

St2-057

St2-057 オンライン標的機環境、Enjoy！ 0x01 docker環境の構築 https://github.com/vulhub/vulhub/tree/master/struts2/s2-048 docker-compose up -d 0x02 st2-057脆弱性環境の構築 docker exec -i -t 88fd8d560155 /bin/bash バックグラウンドで起動してdockerに入る 公式発表によると https://struts.apache.org/releases.html Release Release Date Vulnerability...

Jboss Application Server - Remote Code Execution

Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing a...

Rocket.Chat <=3.13 - NoSQL Injection

Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected...

Apache httpd <=2.4.29 - Arbitrary File Upload

Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell 脆弱性完全再現記録 本記録は、Vulhub が提供する Apache Solr 8.11.0 のターゲット環境に基づき、Log4j2 JNDI インジェクション脆弱性を完全に再現し、DNSLog およびローカル LDAP リスニングによって脆弱性の存在を確認したものです。 一、実験環境 オペレーティングシステム : Windows 11 + WSL2 Ubuntu コンテナプラットフォーム : Docker Desktop 4.76 ターゲット環境の出典 : Vulhub vulhub/log4j/CVE-2021-44228 対象サービ...

ElasticSearch <1.6.1 - Local File Inclusion

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...