EUVD-2026-87142

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

CVE-2026-97871 Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

CVE-2026-97871

A code injection vulnerability exists in Zhonglun CloudPos versions up to 3.0.1.76 . The flaw resides in the OpenLocalBrowser function within the ZlPos/ZlPos/Bizlogic/JSBridge.cs file of the JSBridge component. An attacker can exploit this by manipulating the url argument to execute code remotely...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Ejecución Remota de Código No Autenticada en Langflow Prueba de concepto PoC para CVE-2025-3248 , una vulnerabilidad de ejecución remota de código no autenticada en Langflow, una plataforma de construcción de flujos de trabajo para IA/LLM. Versiones afectadas: Langflow 1.3.0...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS 未经身份验证的远程代码执行（通过自动登录绕过） 📋 概述 CVE-2026-9198 是 IBM Langflow OSS 中的一个关键未经身份验证的远程代码执行漏洞。该利用程序链式利用了以下两个漏洞： CVE-2026-9103 ：自动登录绕过，允许未经身份验证的调用者获取超级用户 JWT 令牌 CVE-2026-8481 ：/api/v1/validate/code 端点中的代码注入，允许任意 Python 执行 ⚠️ 警告 ：此工具仅用于授权的安全测试和教育目的。未经授权的使用是非法的。 🚀 特性 🔓 自动登录绕过 —...

DS-Wireless-Communication-Remote-Code-Execution

DS 无线通信远程代码执行 将任意代码注入客户端游戏。 前置要求 Python 3.10 pip pydivert 使用方法 pip install -r requirements.txt python dswirelesscommunicationremotecodeexecution.py CVE-ID CVE-2023-45887 许可证 GNU 通用公共许可证 v2.0...

Debinject

Debinject .debファイルに悪意のあるコードを注入します メンテナー Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec デモ動画 クローン git clone https://github.com/UndeadSec/Debinject.git 実行方法 cd Debinject python debinject.py 前提条件 python 2.x dpkg dpkg-deb metasploit 免責事項 教育目的のみに使用すること...

CVE-2026-70553-PoC

CVE-2026-70553 - MaxSite CMS 未认证远程代码执行漏洞 CVE-2026-70553 概念验证：通过安装端点向 database.php 持久化注入 PHP 代码，实现未认证远程代码执行。 免责声明 本 PoC 仅用于教育和授权安全研究目的 。作者不对因使用此代码造成的任何滥用或损害负责。仅对您拥有或已获得明确书面授权的系统进行测试。 漏洞概述 MaxSite CMS 105.2 至 109.5 版本的安装端点存在严重的未认证远程代码执行漏洞。dbdbprefix 参数在未经过滤的情况下直接拼接到 PHP 代码中，攻击者可以向...

ShimMe

ShimMe 来自 DEFCON 32 演讲 "SHIM me what you got - Manipulating Shim and Office for Code Injection" 的工具 Office 注入器 - 调用 OfficeClickToRun 服务中的 RPC 方法，将 DLL 注入到由任务计划程序服务启动、以 NT AUTHORITY\SYSTEM 身份运行的挂起进程中，从而实现从管理员到 SYSTEM 的权限提升。 Shim 注入器 - 将未公开记录的 shim 数据结构写入另一个进程的内存，使 apphelp.dll 对该进程应用 “Inject Dll”...

Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeitarticlespaginationcallback function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

PT-2026-98320

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 Description An issue exists where public Relying Parties in PKCE or secret mode can bypass Proof Key for Code Exchange PKCE, a security extension for OAuth 2.0 that prevents authorization co...

Remote Desktop client for Windows Desktop (September 2026)

The Remote Desktop client for Windows Desktop installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper control of generation of code 'code injection' in Remote Desktop Client allows an unauthorized attacker to execute code ove...

Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network...

FreeBSD : p5-Image-ExifTool -- code injection via crafted media (bba381b5-b842-11f1-8205-107c614c014e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bba381b5-b842-11f1-8205-107c614c014e advisory. ExifTool versions up to 13.53 contain a code injection flaw in the Processmrld function of...

ansible-bashpocalypse

CVE-2014-6271 补丁 https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ 使用方法 在本地主机上安装 ansible。 将你想要修补的服务器添加到 inventory 中。 运行 ansible-playbook ./deploy.yml -i inventory。...

0-click-RCE-Exploit-for-CVE-2024-50498

CVE-2024-50498 / 0-Click RCE 漏洞利用 作者：Joshua Provoste https://x.com/JoshuaProvoste/status/1858512517774868845 该仓库包含针对 CVE-2024-50498 的概念验证（PoC）漏洞利用代码，该漏洞是 LUBUS WP Query Console WordPress 插件中存在的一个未经身份验证的代码注入漏洞，可导致远程命令执行（RCE）。 脚本功能 该脚本向存在漏洞的 REST 端点发送精心构造的 POST 请求，以注入并执行任意 PHP 代码。它会将 Web 后门写入...

asminject

asminject.py asminject.py 是 David Buchanan 的 dlinject 项目 的一个大幅修改版分支。它通过访问 /proc//mem 而不是通过 ptrace 附加，将任意汇编（或预编译二进制）有效载荷直接注入 x86-64、x86 和 ARM32 Linux 进程。可用于篡改受信任的进程、某些后渗透场景、从进程内存中恢复内容，以及绕过某些安全控制。只要你在主机上拥有 root 权限，就可以从容器外部注入容器化进程。 你也可以在 Bishop Fox 工具页面上阅读更多关于 asminject.py 及其起源的信息，包括 一篇详细阐述启发该工具的写作。...

CVE-2025-3248

Technical Analysis & Defensive Guide: CVE-2025-3248 Langflow Code Injection An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow. 📌 Vulnerability Profile CVE ID: CVE-2025-3248 Vulnerability Type: Remote Code Execution RCE /...

electroniz3r

electroniz3r Toma el control de los permisos de TCC de las aplicaciones Electron de macOS con electroniz3r. La herramienta se presentó por primera vez en DEFCON31 en Las Vegas durante mi charla ELECTRONizing macOS privacy - a new weapon in your red teaming armory. Descripción general $ electroniz...