roundcube-cve-2025-49113-lab

"免责声明：仅供教育用途" Roundcube Webmail 远程代码执行 – CVE-2025-49113 实验室 本仓库记录了我在受控实验室中逐步利用 Roundcube Webmail CVE-2025-49113 以获取存储在 /secret.txt 中秘密的过程。 ⚠️ 免责声明 所有工作均针对我拥有测试授权的实验室/训练环境进行。 请勿 将这些技术用于你不拥有或未管理权限的系统。 挑战 Roundcube Webmail 是一款基于浏览器、开源的 PHP 电子邮件客户端，通过 IMAP 连接邮箱并通过 SMTP 发送邮件。它通常运行在 Apache 或 Nginx 上，配合...

CVE-2025-52691

CVE-2025-52691 SmarterMail 未授权任意文件上传远程代码执行 概述 严重未授权任意文件上传，允许远程代码执行。 字段| 值 ---|--- 产品| SmarterMail 受影响版本| Build 9406 及更早 CVSS| 10.0（严重） 类型| 任意文件上传 攻击向量| HTTP（未授权） 影响| 远程代码执行 攻击流程 flowchart LR AAttacker -- B"Find Upload Endpoint" B -- C"/api/upload" C -- D"Upload ASPX Shell" D -- E"Path Traversal" ...

CVE-2025-69460

CVE-2025-69460 – Simple Image Gallery 1.0 Ejecución Remota de Código RCE No Autenticado WriteUp CVE-2025-69460 – ExploitDB 50214...

Writing-Sample-1

Log4j: CVE-2021-44228 Summary of Log4j Vulnerability & Mitigations Table of Contents 1. Executive Summary 2. Identification of Vulnerable Endpoints and Services 3. Mitigations A. Block at the Border B. Install Endpoint Detection & Response EDR on Server Endpoints C. Place Vulnerable Enterprise Ap...

CVE-2011-2523

CVE-2011-2523 - Exploit de puerta trasera en vsftpd 2.3.4 Este es un script de exploit basado en Python para la infame puerta trasera encontrada en vsftpd versión 2.3.4. Cuando se activa, abre un shell en el puerto 6200, otorgando ejecución remota de comandos como el usuario root en algunas...

magento2-cosmic-sting-patch

Parche de Magento 2 para CVE-2024-34102 también conocido como Cosmic Sting Una solución alternativa como extensión de Magento 2 para corregir la vulnerabilidad XXE CVE-2024-34102 también conocida como Cosmic Sting. Si no puede actualizar Magento o no puede aplicar el parche oficial, pruebe esta. ...

EUVD-2026-84957

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-84941

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

EUVD-2026-84940

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data...

EUVD-2026-84965

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

EUVD-2026-84966

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity...

EUVD-2026-84973

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

React-Server-Components-Remote-Code-Execution-CVE-2025-55182-

此存储库没有 README。...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

EUVD-2026-85403

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

Linux Distros Unpatched Vulnerability : CVE-2026-91727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process...

Linux Distros Unpatched Vulnerability : CVE-2026-91741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

Linux Distros Unpatched Vulnerability : CVE-2026-91743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitra...

GitLab 19.2 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-93577)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...