jmrozanec__cron-utils_CVE-2021-41269_9-1-5

cron-utils We define crons. And support them. cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. The project follows the Semantic Versioning Convention, provides OSGi metadata and uses Apache 2.0 license. Download cron-utils...

CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 Exploit PoC Overview This repository contains a script that exploits the CVE-2023-22622 vulnerability in WordPress, causing a Denial of Service DoS via WP-Cron. This script can be used to flood a vulnerable WordPress site with requests, potentially leading to server...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - Authentication Bypass Proof Of Concept An authentication bypass was recently discovered https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ on WP Time Capsule 1.21.16 . This PoC prove how the issue works and how it can be...

CVE-2026-5027

CVE-2026-5027 - Langflow 路径遍历导致远程代码执行 描述 Langflow 1.8.4 及更早版本未对 POST /api/v2/files 端点中的 filename 参数进行清理。攻击者可以利用路径遍历序列（../）将文件写入文件系统上的任意位置。结合 Langflow 默认的自动登录配置，该漏洞可在无需任何身份验证的情况下被利用，通过 cron 任务注入实现以 root 权限执行远程代码。 受影响版本 受影响： Langflow = 1.8.4 已修复： 撰写本文时暂无可用补丁 默认配置： 自动登录已启用（可未授权利用） 安全公告： Tenable...

CVE-2024-36821

CVE-2024-36821 The public reference that contains the minimum require information for the vulnerability covered by CVE-2024-36821 The original video with PoC you may find on the video - https://www.youtube.com/watch?v=6vHno0ik7JY The PoC: 1. Connect to the router witnin UART conenction 2. Using...

CVE-2026-18595

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-80099

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18595 WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV 精确配置 RCE 与 root 变体重现 本目录是一个独立的、授权实验室内使用的复现捆绑包，用于无账户 ZendTo 到 ClamAV 代码执行链，以及其独立的默认配置 Smarty/root-cron 后续阶段。它包含： 完整的可运行 PoC 依赖闭包； 用于构建 Docker 目标拓扑的脚本与溯源记录； 与经测试的 systemd/socket 生命周期匹配的 Docker Compose 定义； fail-closed（默认拒绝）的镜像、软件包、二进制、配置、CVD、DAC、cron、PHP、 MAC 及文件系统语义检查；以及...

redis-exploitation

redis-exploitation CONFIG SET For educational purposes only Build root@kitploit: $ docker build -t victim . Run root@kitploit: $ docker run -d --name victim victim Attack root@kitploit: $ docker exec -it victim bash root@kitploit: root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 /...

WordPress WP-Lister Lite for eBay plugin <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability

Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.9...

CVE-2026-72710

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

Cron Job Injection in Remote Backup

...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

CVE-2026-52831

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...