Lucene search
+L

135 matches found

Kitploit
Kitploit
added 2026/09/13 4:13 p.m.5 views

Node.js-CVE-2024-39943

Node.js HFS Command Execution Vulnerability CVE-2024-39943 White Hat School 3rd – Jeongmin Noh @JenmrR Summary In a Node.js-based HFS server environment, there is a vulnerability where the content of an uploaded file is executed via childprocess.execSync. An attacker can directly execute OS...

9.9CVSS8.3AI score0.37493EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 10:48 a.m.12 views

Flowise-RCE-CVE-2025-59528

CVE-2025-59528 — Flowise AI Authenticated Remote Code Execution RCE Overview CVE ID: CVE-2025-59528 Affected Software: Flowise AI Vulnerable Versions: = 3.0.4 Fixed Version: 3.0.5 and later Severity: Critical Author: r3nsi15 Date: 2025 Description Flowise AI versions up to and including 3.0.4 all...

10CVSS7.9AI score0.86218EPSS
SaveExploits23
Kitploit
Kitploit
added 2026/09/12 2:17 p.m.5 views

Suricata-Rule-for-Detecting-CVE-2025-55182

Regla de Detección de Suricata para CVE‑2025‑55182 Envenenamiento de Acción de Next.js → RCE de Node.js con execSync 📌 Descripción Este documento explica cómo la regla de Suricata SID 900304 detecta intentos de explotación de CVE‑2025‑55182 , una vulnerabilidad crítica en Next.js que permite Acti...

10CVSS7.5AI score0.99802EPSS
SaveExploits391
Kitploit
Kitploit
added 2026/09/12 1:28 p.m.7 views

POC-CVE-2025-55182

CVE-2025-55182 Advanced Scanner A full-featured exploitation utility for CVE-2025-55182 — Remote Code Execution via React Server Components in Next.js. The scanner automatically crafts the multipart payload and abuses process.mainModule.require'childprocess'.execSync to achieve arbitrary OS comma...

10CVSS7.3AI score0.99802EPSS
SaveExploits391
Kitploit
Kitploit
added 2026/09/12 10:10 a.m.6 views

CVE-2024-39943-Poc

CVE-2024-39943-Poc CVE-2024-39943 rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in...

9.9CVSS8.2AI score0.37493EPSS
SaveExploits1References1
Github Security Blog
Github Security Blog
added 2026/09/10 10:34 p.m.10 views

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

SaveExploits0References4Affected Software1
OSV
OSV
added 2026/09/10 10:34 p.m.6 views

GHSA-4X45-GXVP-6283 @argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

7.5CVSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 11:49 a.m.7 views

CVE-2025-55182

CVE-2025-55182 root@kitploit: POST /formaction HTTP/1.1 Host: localhost Content-Type: multipart/form-data; boundary=----Boundary Content-Length: 297 ------Boundary Content-Disposition: form-data; name="$ACTIONREF0" ------Boundary Content-Disposition: form-data; name="$ACTION0:0"...

10CVSS7.5AI score0.99802EPSS
SaveExploits391
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.10 views

PT-2026-89735

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

7.5CVSS
SaveExploits0References5
Snyk
Snyk
added 2026/09/09 6:01 p.m.3 views

Allocation of Resources Without Limits or Throttling

Overview github.com/containerd/containerd/pkg/cri/server is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer an...

6.8CVSS
SaveExploits0References2
OSV
OSV
added 2026/09/09 6:01 p.m.3 views

GHSA-7JXH-36Q5-GCQV containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

6.8CVSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/09/09 6:01 p.m.13 views

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

SaveExploits0References6Affected Software2
Snyk
Snyk
added 2026/09/09 6:01 p.m.5 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the drainExecSyncIO function in internal/cri/server/containerexecsync.go, pkg/cri/server/containerexecsync.go, and pkg/cri/sbserver/containerexecsync.go. An attacker can cause...

6.8CVSS
SaveExploits0References2
Snyk
Snyk
added 2026/09/09 6:01 p.m.5 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the drainExecSyncIO function in internal/cri/server/containerexecsync.go, pkg/cri/server/containerexecsync.go, and pkg/cri/sbserver/containerexecsync.go. An attacker can cause...

6.8CVSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/07 3:54 a.m.8 views

Info-Sys-Security-CVE-2025-55182

CVE-2025-55182 Security Lab "React2Shell" This repository contains a local academic lab for analyzing CVE-2025-55182 in a controlled React Server Components environment. The lab simulates the vulnerability, its exploitation, and the applied patch. 📁 Repository Layout Core Applications...

10CVSS7.5AI score0.99802EPSS
SaveExploits391
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.8 views

PT-2026-89204

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

6.8CVSS
SaveExploits0References11
NVD
NVD
added 2026/08/27 1:18 p.m.10 views

CVE-2026-81562

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

5.3CVSS0.00634EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/27 11:30 a.m.32 views

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

5.3CVSS0.00634EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/27 11:30 a.m.9 views

EUVD-2026-67004

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

5.3CVSS5.3AI score0.00634EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/27 11:30 a.m.15 views

CVE-2026-81562

CVE-2026-81562 is an OS command injection vulnerability in AlexGladkov claude-in-mobile version 3.10.2 , affecting the execSync function in the file src/adb/client.ts . A local attacker with low privileges can manipulate input to inject operating system commands, leading to partial compromise of ...

5.3CVSS5.3AI score0.00634EPSS
SaveExploits0References8
Rows per page
Query Builder