Lucene search
+L

341 matches found

Kitploit
Kitploit
added 2026/09/17 3:27 a.m.8 views

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML Parsing Remote Code Execution Vulnerability Reproduction and Analysis Overview ShardingSphere is an open-source ecosystem under Apache, a set of distributed database middleware solutions composed of three independent frameworks: Sharding-JDBC,...

9.8CVSS8.5AI score0.33918EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 7:01 p.m.9 views

CVE-2022-47986

CVE-2022-47986 为什么 该漏洞已在野外被利用。 IceFire 利用此漏洞在目标系统上部署勒索软件,我希望帮助 SOC/蓝队识别受影响系统,帮助渗透测试/红队利用并报告漏洞。 描述 我提供了纯 Python 和 Ruby 脚本、Metasploit 和 Nmap 模块,用于利用 IBM Aspera Faspex 中因 YAML 反序列化导致的 RCE(远程代码执行)漏洞。 利用:RCE(远程代码执行) Python root@kitploit: python3 CVE-2022-47986.py OR chmod u+x CVE-2022-47986.py...

9.8CVSS8.3AI score0.99968EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/16 4:03 p.m.7 views

CVE-2021-41078

CVE-2021-41078 nameko 由于 YAML 反序列化导致的任意代码执行 NVD 描述 Nameko 直到 2.13.0 版本在反序列化配置文件时可能被诱骗执行任意代码。 演示 设置 1. 从 Dockerfile 构建镜像 root@kitploit: docker build -t cve-2021-41078 . 2. 在新容器中运行 python main.py root@kitploit: docker run -it --rm cve-2021-41078 输出 /etc/passwd root@kitploit:...

7.8CVSS7.7AI score0.01537EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/16 1:21 p.m.8 views

CVE-2022-31691

CVE-2022-31691 A write-up of my so far inconclusive look into CVE-2022-31691. Background I'm a frequent user of the Spring Tool Suite STS for Eclipse, and tend to rely on it to initialise new Spring Boot projects. This vulnerability see https://tanzu.vmware.com/security/cve-2022-31691 is an RCE...

9.8CVSS8.4AI score0.02643EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 4:55 p.m.11 views

CVE-2021-46364

CVE-2021-46364: Magnolia CMS中的YAML反序列化 Magnolia(版本 =6.2.3)使用了Snake YAML解析器,该解析器存在反序列化漏洞,攻击者在导入YAML文件时可以调用任意Java构造器。 已利用此漏洞实现了远程代码执行。 供应商披露: 供应商对此漏洞的披露和修复可在此处找到。 要求: 此漏洞需要: 有效的用户凭证 概念验证: 更多细节和利用过程可在此PDF中找到。...

7.8CVSS7.3AI score0.01573EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/15 8:18 a.m.10 views

CVE-2025-56815

CVE-2025-56815 Datart 1.0.0-rc.3 在 POST /viz/image 接口中存在目录遍历漏洞,因为服务器直接使用 MultipartFile.transferTo 将上传的文件保存到用户可控的路径,并且缺乏对文件名的严格验证。 root@kitploit: POST /api/v1/files/viz/image?ownerType=DASHBOARD&ownerId=66822c13a9bc4381923456c11339497e&fileName=../../../../../../../../tmp/1 HTTP/1.1 Host: test.com...

8.8CVSS6.5AI score0.01351EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/12 2:21 p.m.8 views

CVE-2013-0156

原始脚本参考 有关原始利用脚本的更多详细信息,请参考 Gist 链接 CVE-2013-0156 CVE-2013-0156 利用脚本 此脚本专为解决 PentesterLab 上 CVE-2013-0156 利用的挑战而设计。您可以在此处访问该挑战:PentesterLab - CVE-2013-0156 挑战。 此 Python 脚本旨在利用 CVE-2013-0156 漏洞,这是 Ruby on Rails 应用程序中因 YAML 对象的不安全反序列化而导致的严重远程代码执行(RCE)问题。该漏洞允许攻击者通过精心构造的 YAML 载荷注入任意代码,从而在目标服务器上执行代码。...

7.5CVSS8.7AI score0.99449EPSS
SaveExploits21References1
Kitploit
Kitploit
added 2026/09/10 10:58 a.m.7 views

CVE-2013-0156

...

7.5CVSS8.6AI score0.99449EPSS
SaveExploits21
RedhatCVE
RedhatCVE
added 2026/09/02 2:33 p.m.7 views

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

6.4AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/09/02 2:33 p.m.8 views

CVE-2026-76594

A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...

8.1CVSS6.2AI score
SaveExploits0References3
OSV
OSV
added 2026/09/01 3:18 p.m.16 views

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

8.7CVSS6.3AI score
SaveExploits0References8
CVE
CVE
added 2026/09/01 3:18 p.m.34 views

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

8.8CVSS6.3AI score0.00371EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/19 3:17 p.m.19 views

CVE-2026-53451

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

9.8CVSS0.00725EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/19 2:45 p.m.46 views

CVE-2026-53451

Ground Station (a browser-based suite for satellite tracking, SDR reception, and telemetry decoding) prior to version 0.4.13 is vulnerable to unauthenticated remote code execution via a path traversal in the save-waterfall-snapshot Socket.IO command. The snapshotName parameter is passed to os.pat...

9.8CVSS5.4AI score0.00725EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/07/13 4:53 p.m.88 views

Exploit for Improper Input Validation in Pyyaml

Seal Security — Python pip Example A minimal, intentionally...

10CVSS6.5AI score0.05984EPSS
SaveExploits1
CVE
CVE
added 2026/07/10 9:49 p.m.88 views

CVE-2026-44795

CVE-2026-44795 affects Spinnaker (Cloud deployments/baking paths) where unsafe YAML processing bypasses safe deserialization via a non-safe constructor, enabling arbitrary Java class loading and remote code execution. Affected versions precede fixed releases and include 2026.1.0, 2026.0.3, 2025.4...

8.8CVSS6.3AI score0.01012EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/07/10 9:49 p.m.15 views

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

8.8CVSS6.3AI score
SaveExploits0References6
PyPA
PyPA
added 2026/07/07 4:03 p.m.27 views

docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

ImpactA PyYAML-related Remote Code Execution RCE vulnerability, namely CVE-2020-14343, is exposed in docling-core =2.21.0, 2.48.4 and, specifically only if the application uses pyyaml 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml passing it untrusted YAML data. PatchesThe...

10CVSS6.2AI score0.05984EPSS
SaveExploits2References9Affected Software1
OSV
OSV
added 2026/07/07 4:03 p.m.17 views

PYSEC-2026-1366 Feast vulnerable to Deserialization of Untrusted Data

A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at feast/sdk/python/feast/infra/computeengines/kubernetes/main.py. The vulnerability arises from the use of yaml.load..., Loader=yaml.Loader to...

7.8CVSS7.9AI score0.003EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/07 4:02 p.m.15 views

PYSEC-2026-1683 MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

Description A Remote Code Execution RCE vulnerability exists in the modelscope/ms-swift project due to unsafe use of yaml.load in combination with vulnerable versions of the PyYAML library ≤ 5.3.1. The issue resides in the tests/run.py script, where a user-supplied YAML configuration file is...

9.8CVSS6.5AI score0.02473EPSS
SaveExploits1References10
Rows per page
Query Builder