159 matches found
CVE-2021-32156
..| CSRF 到 RCE CRON |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过 Webmin 的计划 Cron 任务功能来实现远程命令执行（RCE）。 测试版本： Webmin 1.973（GitHub 的最新版本 07/03/2021） 攻击类型： 远程 影响： 远程命令执行 漏洞利用代码 POC： 产品厂商： https://www.webmin.com 附加信息： “Webmin 是一种基于 Web 的系统管理工具，适用于类 Unix 服务器和服务，全球安装量超过...
Persistnux
Persistnux 一个全面的Linux持久化检测工具，用于数字取证和事件响应（DFIR）调查。 概述 Persistnux 是一个基于 Bash 的工具，旨在识别攻击者用于维护对受感染系统访问权限的已知 Linux 持久化机制。它对系统执行全面检查，并生成 CSV 和 JSONL 格式的详细报告，便于进一步分析。 特性 全面检测 ：覆盖所有主要的 Linux 持久化机制 实时分析 ：直接在运行中的系统上运行，依赖最小 详细输出 ：生成 CSV 和 JSONL 报告，包含文件哈希、元数据和置信度评分 支持 Root 和非 Root ：可在有或没有 root 权限的情况下运行（非 roo...
CVE-2021-32157
..| XSS para RCE CRON|.. Descrição : Explorando um ataque de Cross-Site Scripting refletido XSS para obter uma execução remota de comandos RCE através do recurso de tarefas Cron agendadas do Webmin Versão Testada : Webmin 1.973 versão mais recente do GitHub 07/03/2021 Tipo de Ataque: Remoto Impac...
CVE-2026-62202
OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...
CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...
CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...
PT-2026-60613
OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
CVE-2025-57819 — FreePBX Unauthenticated SQLi → RCE One-shot...
CVE-2026-45661 Dokploy: Remote Code Execution through Path Traversal
Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote serve...
CVE-2026-45661
Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote serve...
CVE-2026-45661
Dokploy
PT-2026-44938
Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.6 Description Dokploy is a self-hostable Platform as a Service PaaS containing a path traversal issue. This allows authenticated users to write arbitrary files to the filesystem during application deployment. Whe...
CVE-2026-41472
CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findingsjson field of...
CVE-2026-34783
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a...
CVE-2026-34783 Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a...
EUVD-2026-19353
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a...
Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers
Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research Team. "Instead of exposing command execution through URL parameters or request...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the IO::FS::WRITE function. An attacker can write arbitrary files to unintended locations on the filesystem with attacker-controlled content by supplying crafted filenames containing traversal sequences, which ar...
PT-2026-29811
Name of the Vulnerable Software and Affected Versions: Ferret versions prior to 2.0.0-alpha.4 Description: Ferret is a declarative system for working with web data. A path traversal vulnerability exists in the IO::FS::WRITE standard library function, allowing a malicious website to write arbitrar...
Wallos 代码问题漏洞
Wallos is an open-source personal subscription tracker developed by Miguel Ribeiro. Versions of Wallos prior to 4.7.0 had code vulnerabilities. These vulnerabilities stemmed from incomplete SSRF protections, and the save endpoint did not apply the validatewebhookurlforssrf protection. This allowe...