CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – xsl:script による XSLT サーバーサイドインジェクション プログラムコード（Python + XSLT） xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt =...

Magento-ver.-2.4.6

익스플로잇 제목: FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection 날짜: 2023-11-17 익스플로잇 작성자: tmrswrr 공급업체 홈페이지: FireBear Studio 소프트웨어 링크: FireBear Studio Improved Import & Export 버전: FireBear Improved Import & Export ver. 3.8.6 POC 1. 이 URL에 관리자 자격 증명으로...

CVE-2019-25137-Version-Research

CVE-2019-25137 영향 받는 버전 연구 CVE-2019-25137 개요 CVE-2019-25137은 Umbraco CMS의 XSLT 인젝션 취약점입니다. 이 취약점은 XSLTExtensive Stylesheet Language Transformations Visualizer 웹페이지에 존재합니다. 이 웹페이지의 취약한 URI는 /umbraco/developer/Xslt/xsltVisualize.aspx입니다. XSLT Visualizer를 성공적으로 악용하면 대상 시스템에서 C 코드가 실행될 수 있습니다. 취약점을...

CVE-2026-4813

CVE-2026-4813（CVSS-B 9.4 重大） Lutece Core 详细说明及更多内容请访问我的网站 5. 保存新的 XSL 表。 6. 导航至导出用户页面： /jsp/admin/user/ExportUsers.jsp 7. 选择我们刚刚创建的转换表并确认。 8. id 命令的结果应出现在导出的文件中。...

Lutece Core 7.1.7 Remote Code Execution

Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...

CVE-2026-58400

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

Exploit for CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via...

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution RCE on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the...

Bludit CMS 3.22.0 Cross Site Scripting

Bludit CMS version 3.22.0 suffers from an SVG related cross site scripting vulnerability. Exploit Title: Bludit CMS - Stored XSS Date: 2026-07-30 Exploit Author: Saud Alenazi Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0 Version: 3.22....

Bludit CMS - Stored XSS

Exploit Title: Bludit CMS - Stored XSS Date: 2026-07-30 Exploit Author: Saud Alenazi Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0 Version: 3.22.0 Tested on: Windows 10 x64 Description: sanitizeSVG strips script/on but does not remove...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Oracle Peoplesoft_Enterprise_Hcm_Human_Resources

--- CVE-2026-22006 – XSLT Server‑Side Injection via xsl:scr...

📄 Oracle E-Business Suite CVE-2025-61882 Remote Code Execution

This Metasploit module exploits CVE-2025-61882 in Oracle E-Business Suite by combining server-side request forgery, path traversal, HTTP request smuggling, and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to remote code execution. This...

Oracle E-Business Suite CVE-2025-61882 RCE

This module exploits CVE-2025-61882 in Oracle E-Business Suite by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to RCE. This module provides an interactive shell session. Vulnerable...

EUVD-2024-22744

Malicious code in bioql PyPI...

EUVD-2024-2364

Malicious code in bioql PyPI...

EUVD-2022-27972

Malicious code in bioql PyPI...

CVE-2024-25413

A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2022-22834

An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution...

GHSA-HHWC-GH8H-9RRP Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...