CVE-2026-4813

CVE-2026-4813（CVSS-B 9.4 重大） Lutece Core 详细说明及更多内容请访问我的网站...

CVE-2019-25137-Version-Research

CVE-2019-25137 影響を受けるバージョンの調査 CVE-2019-25137 概要 CVE-2019-25137 は、Umbraco CMS における XSLT インジェクションの脆弱性です。この脆弱性は、XSLT Extensive Stylesheet Language Transformations Visualizer の Web ページに存在します。この Web ページの脆弱な URI は /umbraco/developer/Xslt/xsltVisualize.aspx です。 XSLT Visualizer が悪用されると、標的のシステム上で C...

Magento-ver.-2.4.6

エクスプロイトタイトル: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection 日付: 2023-11-17 エクスプロイト作者: tmrswrr ベンダーホームページ: FireBear Studio ソフトウェアリンク: FireBear Studio Improved Import & Export バージョン: FireBear Improved Import & Export ver. 3.8.6 PoC 1...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – xsl:script による XSLT サーバーサイドインジェクション プログラムコード（Python + XSLT） root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt ...

Lutece Core 7.1.7 Remote Code Execution

Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...

CVE-2026-58400

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

📄 Oracle E-Business Suite CVE-2025-61882 Remote Code Execution

This Metasploit module exploits CVE-2025-61882 in Oracle E-Business Suite by combining server-side request forgery, path traversal, HTTP request smuggling, and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to remote code execution. This...

Oracle E-Business Suite CVE-2025-61882 RCE

This module exploits CVE-2025-61882 in Oracle E-Business Suite by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to RCE. This module provides an interactive shell session. Vulnerable...

EUVD-2024-22744

Malicious code in bioql PyPI...

EUVD-2022-27972

Malicious code in bioql PyPI...

EUVD-2024-2364

Malicious code in bioql PyPI...

CVE-2024-25413

A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2022-22834

An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution...

GHSA-HHWC-GH8H-9RRP Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The CVE-2024-36522 issue affects Apache Wicket’s XSLTResourceStream.java default configuration, where processing input from untrusted sources can lead to remote code execution via XSLT injection. Concretely, the vulnerability centers on the default parsing/stream handling path, enabling an attack...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...