CVE-2026-4813

CVE-2026-4813（CVSS-B 9.4 严重） Lutece Core 更多说明请访问我的网站 5. 保存新的 XSL 表。 6. 导航至导出用户页面： /jsp/admin/user/ExportUsers.jsp 7. 选择我们刚刚创建的转换表并确认。 8. id 命令的执行结果应出现在导出的文件中。...

CVE-2019-25137-Version-Research

CVE-2019-25137 影響を受けるバージョンの調査 CVE-2019-25137 概要 CVE-2019-25137 は、Umbraco CMS における XSLT インジェクションの脆弱性です。この脆弱性は、XSLT Extensive Stylesheet Language Transformations Visualizer の Web ページに存在します。この Web ページの脆弱な URI は /umbraco/developer/Xslt/xsltVisualize.aspx です。 XSLT Visualizer が悪用されると、標的のシステム上で C...

Magento-ver.-2.4.6

Exploit 标题：FireBear Studio Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT 服务端注入 日期： 2023-11-17 漏洞作者： tmrswrr 厂商主页： FireBear Studio 软件链接： FireBear Studio Improved Import & Export 版本： FireBear Improved Import & Export ver. 3.8.6 POC 1. 使用管理员凭据访问此...

CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – 通过 xsl:script 的 XSLT 服务端注入 程序代码（Python + XSLT） root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml = request.form'xml' xslt =...

Lutece Core 7.1.7 Remote Code Execution

Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...

CVE-2026-58400

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

📄 Oracle E-Business Suite CVE-2025-61882 Remote Code Execution

This Metasploit module exploits CVE-2025-61882 in Oracle E-Business Suite by combining server-side request forgery, path traversal, HTTP request smuggling, and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to remote code execution. This...

Oracle E-Business Suite CVE-2025-61882 RCE

This module exploits CVE-2025-61882 in Oracle E-Business Suite by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection. The exploit hosts a malicious XSL file that the target will fetch and process, leading to RCE. This module provides an interactive shell session. Vulnerable...

EUVD-2024-22744

Malicious code in bioql PyPI...

EUVD-2022-27972

Malicious code in bioql PyPI...

EUVD-2024-2364

Malicious code in bioql PyPI...

CVE-2024-25413

A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2022-22834

An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution...

Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

GHSA-HHWC-GH8H-9RRP Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522

The CVE-2024-36522 issue affects Apache Wicket’s XSLTResourceStream.java default configuration, where processing input from untrusted sources can lead to remote code execution via XSLT injection. Concretely, the vulnerability centers on the default parsing/stream handling path, enabling an attack...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...