CVE-2023-22524

Atlassian Companion RCE脆弱性の概念実証 CVE-2023-22524 概要 このリポジトリには、macOS向けAtlassian Companionで最近発見されたリモートコード実行脆弱性（CVE-2023-22524）の概念実証（PoC）が含まれています。この重大な問題により、攻撃者はアプリのブロックリストとmacOS Gatekeeperを迂回し、有害なコードを実行する可能性があります。 詳細...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

CVE-2023-24329-Exploit

简介 URL 解析函数专注于将 URL 字符串拆分为其组成部分，或将 URL 组成部分组合成 URL 字符串。 urllib.parse.urlparse 简单来说 ，urllib.parse 用于解析 URL，我们可以通过在 URL 前添加空格来绕过它。这发生在 Python 3.11.4 及更早版本中。 PoC 让我们分解 example.py 以下是一组你不应访问的网站： blockedlist = "http://example.com/", "http://example2.com/" 此函数检查网站是否在阻止列表中，如果在阻止列表中，则应返回 URL Blocked def...

EXPLOIT-CVE-2026-40901

DataEase——通过四漏洞链实现未认证 RCE（CVE-2026-40901 及相关漏洞） 认证绕过 → JDBC 黑名单绕过（任意文件读取）→ SQL 注入 → Quartz 中的 Java 反序列化 → 以root 身份远程代码执行。 自带完整的本地实验环境（Docker）+ 可用的 PoC。已在 DataEase v2.10.21 中修复。 DataEase 是一个流行的开源 BI / 数据可视化平台（Java / Spring Boot）。≤ v2.10.20 版本存在由四个问题组成的漏洞链，该链可将任何可网络访问的 DataEase 变为远程代码执行： | CVE| 漏洞类...

fastjson-1.2.60-rce

Fastjson = 1.2.60 逆シリアル化の脆弱性 autoType ブロックリストをバイパスする 2 つの Gadgets JNDIConfiguration、OracleManagedConnectionFactory Gadgets 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。 另外的两个类JNDIConfiguration和 OracleManagedConnectionFactory都可以构造出攻击poc，且尚未被加入黑名单。...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Chyrp Lite ≤ 2026.01（“Iriomote”）中的已认证 RCE 漏洞 链式攻击： uploadspath 黑名单绕过（CVE-2026-53768）+ adminupdateupload 缺少文件扩展名验证（CVE-2026-53767）→ 以 www-data 身份远程执行代码 概述 Chyrp Lite ≤ 2026.01 存在已认证远程代码执行链漏洞，任何拥有 changesettings 和 editupload 权限（默认为管理员）的用户均可利用。 |...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload タスク → 認証なし → 3文字列フィルタ回避 概要 Joomla 用 DJ-Classifieds における、認証なしでの任意ファイルアップロード脆弱性。imageupload タスクのエンドポイントは 認証なし でファイルアップロードを処理し、PHP のショートオープンタグ ?= を使うだけで簡単に回避できる 3つの文字列のブロックリスト ?php、eval、base64 に依存しています。GIF ポリグロットと組み合わせることで、アップロードされたファイルは完全に機能する PH...

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61851

Chartbrew is an open-source web application that connects to databases and APIs to create charts. Prior to 5.2.2 , its runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js enforced read-only database access using a blocklist of only seven SQL keywords . An authenticated u...

CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-57141

PraisonAI (praisonai npm, a TypeScript multi-agent AI framework) is vulnerable to remote code execution via its codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts. The tool executes LLM-generated JavaScript using new Function() with a with(sandbox) pattern guarded by a regex blockl...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

VulnCheck KEV: CVE-2026-60105

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...