Magento-ver.-2.4.6

Titolo Exploit: FireBear Studio Improved Import & Export ver. 3.8.6 per Magento 2.4.6 - Iniezione XSLT lato server Data: 2023-11-17 Autore dell'exploit: tmrswrr Homepage del fornitore: FireBear Studio Link al software: FireBear Studio Improved Import & Export Versione: FireBear Improved Import &...

CVE-2019-25137-Version-Research

Ricerca sulle versioni interessate da CVE-2019-25137 Panoramica di CVE-2019-25137 CVE-2019-25137 è una vulnerabilità di iniezione XSLT in Umbraco CMS. La vulnerabilità è presente nella pagina web XSLT Extensive Stylesheet Language Transformations Visualizer. L'URI vulnerabile per questa pagina we...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – XSLT-Server‑seitige Injektion über xsl:script Programmcode Python + XSLT root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml =...

📄 Oracle E-Business Suite CVE-2025-61882 Remote Code Execution

This Metasploit module exploits CVE-2025-61882 in Oracle E-Business Suite by combining server-side request forgery, path traversal, HTTP request smuggling, and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to remote code execution. This...

Oracle E-Business Suite CVE-2025-61882 RCE

This module exploits CVE-2025-61882 in Oracle E-Business Suite by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to RCE. This module provides an interactive shell session. Vulnerable...

EUVD-2024-22744

Malicious code in bioql PyPI...

EUVD-2024-2364

Malicious code in bioql PyPI...

EUVD-2022-27972

Malicious code in bioql PyPI...

CVE-2024-25413

A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2022-22834

An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution...

GHSA-HHWC-GH8H-9RRP Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The CVE-2024-36522 issue affects Apache Wicket’s XSLTResourceStream.java default configuration, where processing input from untrusted sources can lead to remote code execution via XSLT injection. Concretely, the vulnerability centers on the default parsing/stream handling path, enabling an attack...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

PT-2024-4004 · Apache · Apache Wicket

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions prior to 10.1.0 Apache Wicket versions prior to 9.18.0 Apache Wicket versions prior to 8.16.0 Description: The issue is related to incorrect code generation management in the Apache Wicket framework, allowing a remote...

veraPDF has potential XSLT injection vulnerability when using policy files

Impact Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. Patches This has been patched and users should upgrade to veraPDF v1.24.2 Workarounds This doesn't affect the standard validation an...