CVE-2026-86218

CVE-2026-86218 - N-able N-central 사전 인증 RCE 익스플로잇 개요 이것은 N-able N-central의 치명적인 사전 인증 원격 코드 실행 취약점인 CVE-2026-86218에 대한 Python 3 개념 증명proof-of-concept 익스플로잇입니다. 취약점 세부 정보: CVE: CVE-2026-86218 CVSS 점수: 10.0 치명적 CWE: CWE-96 정적 코드 주입 영향받는 버전: N-central options 옵션 옵션| 설명 ---|--- -t, --target| 대상...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Account Takeover to RCE !Python...

CVE-2026-103442

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-103442

The MediaWiki CentralAuth extension versions 1.46, 1.45, and 1.43 are vulnerable to a Code Injection flaw due to an external control of system or configuration settings. While the description mentions a MergeAccount PHP object injection via session-key substitution in related records, the primary...

CVE-2026-103442 MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

EUVD-2026-90075

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin の '/scripts/setup.php' に対する PHP コードインジェクション RCE の POC。これは CVE-2009-1151 用として最初に公開されたエクスプロイトです。 構文 $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ デモ $ ./phpMyAdminRCE.sh...

OESA-2026-4219 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

OESA-2026-4218 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

CVE-2024-43363

CVE-2024-43363 CVE-2024-43363 익스플로잇 스크립트 이 Python 스크립트는 Cacti 인스턴스가 CVE-2024-43363, 즉 로그 중독으로 인해 발생하는 원격 코드 실행RCE 취약점에 취약한지 테스트하도록 설계되었습니다. 취약점 작동 방식: 로그 중독: 공격자가 장치 이름에 PHP 코드를 주입하며, Cacti는 이를 적절한 살균 처리 없이 로그에 기록합니다. 실행: 웹 URL을 통해 로그에 접근하면 주입된 코드가 실행되어, 공격자가 서버에서 명령을 실행할 수 있게 됩니다. 스크립트 작동 방식: 버전...

CVE-2026-55511

CVE-2026-55511: Yamcs StreamSQL 인증된 RCE 비무장화된 개념 증명 및 기술 문서 - Yamcs StreamSQL 집계 표현식 컴파일러의 인증된 Java 코드 인젝션 취약점CVE-2026-55511에 대한 내용입니다. 필드| 값 ---|--- 제품| Yamcs org.yamcs:yamcs-core 권고| GHSA-3g44-3m7x-cgg2 약점| CWE-94: 코드 생성의 부적절한 제어 심각도| 심각, CVSS 3.1: 9.1 벡터|...

CVE-2024-3094-info

CVE-2024-3094-정보 https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin 응답 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection

Ivanti Endpoint Manager Mobile EPMM versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system. id: CVE-2026-1281 info: name: Ivanti EPMM =12.7.0.0 - Unauthenticated Code Injection...

CVE-2026-86131

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

CVE-2026-51861

The software bisheng versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to Code Injection (CWE-94). The flaw is located within the src/backend/bisheng/api/v1/validate.py component. This vulnerability allows for unauthorized code execution, which can lead to high impact on confidentiality , i...

PT-2026-103620

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description Code Injection is possible through the run code function within the Runner class located in src/agents/runner/runner.py. Recommendations As a temporary workaround, consider disabling the run code function until a...

CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

AlmaLinux 9.2 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.2:CLSA-2026:1789389842)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789389842 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacke...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...