CVE-2026-25706 yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

EUVD-2026-69002

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

n8n-CVE-2025-68613-TryHackMe

TryHackMe 房间：n8n：CVE-2025-68613 玩家： J4ck3LSyN 主机： ... 用户名： [email protected] 密码： Try12345! 方法 Payload: function return this.process.mainModule.require'childprocess'.execSync'cat flag.txt'.toString Payload 2: function return this.process.mainModule.require'childprocess'.execSync'cat...

CVE-2025-55182

React2Shell CVE-2025-55182 ⚠️ 警告： 此项目仅用于教育及安全研究目的 。 1. 克隆仓库 root@kitploit: git clone https://github.com/mivmi/CVE-2025-55182.git cd CVE-2025-55182 2. 启动 Docker 容器 root@kitploit: docker-compose up -d 3. 在浏览器中打开 https://localhost:8080...

CVE-2017-5638-Remote-Code-Execution-Apache-Struts2-EXPLOITATION

CVE-2017-5638-远程代码执行-Apache Struts2-利用...

CVE-2026-59681

CVE-2026-59681 is an OS command injection in yast2-auth-client (SUSE/YaST). The vulnerable code in Auth::AuthConf (src/lib/auth/authconf.rb) interpolates unsanitized Active Directory configuration values—Organizational Unit , dnsHostName , AD user name, and AD domain name—directly into net ads jo...

EUVD-2026-69001

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-59681 yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

react2shell-poc-CVE-2025-55182

React2Shell PoC CVE-2025-55182 一个针对 React2Shell CVE-2025-55182 的概念验证 PoC 脚本，这是一个影响使用 Server Actions 的 Next.js 应用的严重远程代码执行 RCE 漏洞。 !WARNING 免责声明 ：此工具仅用于教育和授权测试目的。我对任何滥用行为不承担责任。 描述 该脚本利用了 React Server Components "Flight" 协议中的一个不安全反序列化漏洞。它允许未经身份验证的攻击者在服务器上执行任意 JavaScript 代码，从而实现部分远程代码执行 RCE。 功能...

CVE-2019-9193-Home-Lab

CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE 本实验室模拟 CVE-2019-9193 ，这是一个 PostgreSQL 9.3–11.2 版本中的漏洞，允许： root@kitploit: COPY ... FROM PROGRAM '' 当超级用户或拥有 pgexecuteserverprogram 角色的用户执行时，可以运行操作系统命令。 你的任务是利用此功能读取： root@kitploit: /tmp/flag.txt 目标 1. 连接到 PostgreSQL： 用户：postgres 密码：sentinel7 主机端口：54...

React2Shell-CVE-2025-55182

React2Shell CVE-2025-55182 一个概念验证漏洞利用，演示了通过React服务器组件渲染管道中的原型污染导致Next.js应用程序中存在远程代码执行漏洞。 ⚠️ 免责声明 此工具仅用于教育和授权测试目的。未经授权针对您不拥有或未经许可测试的系统使用是违法的。 📋 先决条件 Node.js（v16或更高版本） Python 3.6+ netcat（用于反弹shell） 一个易受攻击的Next.js应用程序（包含在此仓库中） 🚀 快速开始 选项1：使用预配置的实验室 1. 克隆仓库 root@kitploit: git clone...

SyncShield

🔐 SyncShield — 用于检测 CVE-2018-5764 的浏览器扩展 在 Rsync 命令成为漏洞之前检测不安全命令 一款轻量级、注重隐私的浏览器扩展，作为最终学年项目 NWS/129/23B 的一部分开发，用于检测 Rsync 命令中缺失的 --protect-args 标志 — 预防通过 CVE-2018-5764 进行的远程命令执行。 ✅ 完全离线运行 ✅ 无服务器连接或数据收集 ✅ 实时扫描与警报 ✅ 注重教育与缓解措施 ✅ 面向学生、系统管理员和安全爱好者 👥 团队成员 序号| 姓名| 学号| 角色与职责 ---|---|---|--- 1| Muhammad Nu...

cve-2025-62726-poc

CVE-2025-62726 POC - n8n Git Node RCE 教育目的 本文件是 CVE-2025-62726 的概念验证演示，作为课程项目的一部分，仅用于教育目的。 来自卡内基梅隆大学课程：2025 年秋季学期的 18-739 黑客与攻击安全课程 漏洞概述 CVE ID： CVE-2025-62726 严重程度： CVSS 8.8（高危） 受影响软件： n8n（工作流自动化平台） 受影响版本： 1.113.0 漏洞类型： 通过 Git 钩子实现远程代码执行 RCE CWE 分类： CWE-829（包含来自不受信任控制源的功能） 技术细节 工作原理 1. 攻击向量：...

CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-59680

An OS command injection vulnerability in yast2-users (through 5.0.8 ) allows root-level command execution via a malicious LDAP directory. The flaw is in get_password_term() in src/include/users/dialogs.rb, which reads the shadowLastChange and shadowExpire attributes via GetString() with no numeri...

EUVD-2026-68996

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

BIT-GITLAB-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...