516963 matches found
CVE-2025-60787
CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 Original link: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye RCE via Client-Side Validation Bypass Summary During security testing of a MotionEye instance running in Docker, it was observed that...
CVE-2026-6960
CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 未授权任意文件上传 研究方： Atomic Edge 严重程度： 严重 | CVSS： 9.8 | 需认证： 否 ⚠️ v2 — 已根据社区反馈进行技术修正。 详情请参见更新日志。 概述 BookingPress Pro WordPress 插件（版本 ≤ 5.6）中存在一个严重的未授权任意文件上传漏洞。预约提交处理器 bookingpressbookappointmentbooking 将签名字段值作为 data URI 处理。插件通过正则表达式从 URI 的 MIME...
cve-2025-53770-research
cve-2025-53770-research 🚨 关于 SharePoint “ToolShell” RCE 零日漏洞 CVE-2025-53770 的威胁情报与事件响应研究。🕵️♂️ 涵盖根因反序列化缺陷、攻击时间线、风险指标以及防御性 EDR 验证演练手册。🛡️ 🕵️ CVE-2025-53770 — SharePoint “ToolShell” 零日漏洞研究 关于 Microsoft SharePoint “ToolShell” RCE 零日漏洞的威胁情报与事件响应研究。 涵盖根因反序列化缺陷、攻击时间线、风险指标以及防御性/EDR 验证演练手册。 作者：Muhammad...
cve-2019-13132-lab
CVE-2019-13132 — desbordamiento de pila en CURVE INITIATE de libzmq → laboratorio RCE Exploit RCE funcional de extremo a extremo + laboratorio reproducible para CVE-2019-13132 , un desbordamiento de búfer de pila en el manejador del handshake CURVE INITIATE de libzmq. Un atacante que conozca la...
CVE-2026-35196
CVE-2026-35196 · Chamilo LMS · Inyección de Comandos del SO → RCE Investigador: K Tipo de Divulgación: Divulgación Responsable Estado: Parcheado Producto Afectado: Chamilo LMS 2.0 Confirmado en v1.11.32 📋 Resumen de Vulnerabilidad...
EUVD-2026-68800
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
EUVD-2026-68816
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal @x/../../…/ is therefore extracted outside nodemodules, to an attacker-chosen absolute path,...
EUVD-2026-68883
pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...
CVE-2026-0596-Reproduction
CVE-2026-0596: MLflowエコシステムにおける安全でないデシリアライゼーションによる任意コード実行 mlflow==2.11.1およびmlserver==1.3.5における信頼できないモデル読み込みパイプラインに関連する検証、基礎メカニズム、アーキテクチャ上の脆弱性を詳述した包括的なセキュリティ研究レポート。 ⚠️ 脆弱性インテリジェンス勧告: CVE-2026-0596...
CVE-2026-76595
A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...
CVE-2026-76594
A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...
CVE-2026-20131
🚨 CVE-2026-20131 | Cisco FMC 严重 RCE 漏洞 Cisco Secure Firewall Management Center 中的未认证远程代码执行 📌 概述 一个严重的预认证 Java 反序列化漏洞 ，允许远程攻击者在 Cisco FMC 设备上实现 root 级代码执行 。 关键信息 属性| 详情 ---|--- 严重程度| 严重 CVSS 评分| 10.0 漏洞类型| Java 反序列化 已被在野利用| 是（勒索软件攻击活动） 补丁可用| 是 ✨ 安全的漏洞检测工具 一个美观、安全且可靠的 CVE-2026-20131 检测工具。 📸 演示 功能特性...
CVE-2026-0770
CVE-2026-0770: Langflow execglobals 認証不要のリモートコード実行 PoC CVE-2026-0770 は、Langflow に影響を与える認証不要のリモートコード実行 RCE 脆弱性です。 この欠陥は、/validate エンドポイントに提供される execglobals パラメータの処理における不適切な入力検証に起因します。これを悪用することで、攻撃者は検証ルーチン中に信頼されていないグローバル環境を渡すことができ、root ユーザーのコンテキストでリモートコード実行を達成します。 ! 免責事項 警告:...
kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle
A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...
-Limesurvey-RCE-CVE-2021-44967
🚀 LimeSurvey RCE CVE-2021-44967 - 認証済みリモートコード実行 このリポジトリには、LimeSurvey の認証済みリモートコード実行脆弱性 CVE-2021-44967 の実用的なエクスプロイトが含まれています。 🎯 互換性 テスト済みで動作確認済み: LimeSurvey 5.2.x LimeSurvey 6.x 🐛 脆弱性の概要 この脆弱性により、管理者権限を持つ認証済みユーザーが悪意のあるプラグインをアップロードできます。LimeSurvey...
GHSA-QXC2-J82W-R537 Faker: helpers.fake exploitable into arbritary code execution
Summary faker.helpers.fake can be tricked into arbritary code execution. Details fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after on...