CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch

CVE-2025-24893 – XWikiにおける未認証のリモートコード実行 0 目次 1. 概要 2. 脆弱性の詳細 3. 影響を受けるバージョン 4. 概念実証 4.1 ペイロードの構築 4.2 手動による悪用 4.3 自動エクスプロイト 5. 緩和策 6. クレジットと参考文献 1 概要 CVE: 2025-24893 Component: SolrSearch マクロ XWiki UI Severity: 9.8 / 緊急 CVSS 3.1 Attack vector: 認証不要のHTTP GET Impact: 任意のGroovy実行 → システムレベルのRCE...

CVE-2024-6387-poc-1

OpenSSH의 CVE-2024-6387 regreSSHion 설명 CVE-2024-6387 "regreSSHion"이라는 별명을 가진는 OpenSSH의 심각한 취약점으로, 인증되지 않은 원격 공격자가 취약한 Linux 시스템에서 루트 권한으로 코드를 실행할 수 있게 합니다. 이 취약점은 glibc 기반 시스템에서 OpenSSH 서버 구성 요소sshd의 신호 처리에 있는 경쟁 조건race condition에서 발생합니다. 심각도 높음 CVSS 점수: 8.1 영향 이 취약점의 성공적인 악용은 다음으로 이어질 수 있습니다: 원격 ...

CVE-2022-1388-rs

CVE-2022-1388-rs CVE-2022-1388 F5 BIG-IP iControl REST 認証バイパス RCE のためのスキャナーおよびインタラクティブシェル Rust 製 概要 まとめると、この脆弱性を悪用するためのリクエストに必要な条件の概要は次のとおりです。 Connection ヘッダーに X-F5-Auth-Token が含まれている必要がある X-F5-Auth-Token ヘッダーが存在している必要がある Host ヘッダーが localhost / 127.0.0.1 であるか、Connection ヘッダーに X-Forwarded-Host...

CVE-2021-26084_Confluence

CVE-2021-26084Confluence CVE 2021 26084 Confluence 익스플로잇 dock0d1@arch$ python rce.py...

CVE-2021-1675

CVE-2021-1675 Zhiniang Peng@edwardzpeng & Xuefeng Li@lxf02942370가 처음 제작한 PrintNightmare PoC의 Impacket 구현체 완전히 패치된 2019 도메인 컨트롤러에서 테스트 완료 악성 DLL을 원격 또는 로컬로 실행 설치 익스플로잇을 실행하기 전에 내 버전의 Impacket을 설치해야 합니다. 이후에는 문제없음 root@kitploit: pip3 uninstall impacket git clone https://github.com/cube0x0/impacket ...

CVE-2018-16763-FuelCMS-1.4.1-RCE

CVE-2018-16763 - FuelCMS = 1.4.1 RCE CVE-2018-16763을 통해 FuelCMS = 1.4.1에서 RCE를 트리거하고 대화형 셸을 사용하는 익스플로잇입니다. 기능 CVE-2018-16763을 사용하여 FuelCMS에 PHP 웹셸 API를 자동으로 업로드합니다. ?action=exec을 통해 API로 시스템 명령어를 실행합니다. ?action=download를 통해 원격 시스템에서 공격 머신으로 파일을 다운로드합니다. 사용법 요구사항 : 필요 없음, 이 익스플로잇은 인증 없이 사용 가능합니다...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

DocsGPT - Unauthenticated Remote Code Execution

A vulnerability, that could result in Remote Code Execution RCE, has been found in DocsGPT. Due to improper parsing of JSON data using eval an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0. id:...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Joomla! Portfolio Nexus - Remote File Inclusion

Joomla! Portfolio Nexus 1.5 contains a remote file inclusion vulnerability in the inertialFATE iF comifnexus component that allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2009-4679 info: name: Joomla! Portfol...

ICTBroadcast - Command Injection

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

CMSimple 3.1 - Local File Inclusion

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

SPIP <3.1.2 - Cross-Site Scripting

SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in validerxml.php which allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action. id: CVE-2016-7981 info: name: SPIP 3.1.2 - Cross-Site Scripting author: pikpikcu severity:...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

LotusCMS 3.0 - Remote Code Execution

LotusCMS 3.0 is susceptible to remote code execution via the Router function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution. id: CVE-2011-0518 info: name: LotusCMS 3.0 - Remote Code Execution author: pikpikcu...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

PrestaShop Responsive Mega Menu Module - Remote Code Execution

The 'Responsive Mega Menu' module for PrestaShop is prone to a remote code execution and SQL injection vulnerability. modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop allows remote attackers to execute an SQL injection or...

ThemeREX Addons - Remote Code Execution

ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trxaddons/v2/get/sclayout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trxaddonsrestgetsclayout with an unsafe sc parameter, letting...