Copyparty <=1.18.6 - Cross-Site Scripting

Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. id: CVE-2025-54589...

CVE-2023-23752

설치 git clone https://github.com/0xx01/CVE-2023-23752.git cd CVE-2023-23752 chmod +x exploit.sh 사용법 ./exploit.sh http://localhost...

CVE-2021-26084

使用方法: python poc.py http://host:port/...

CVE-2021-3019

CVE-2021-3019 ip를 ip.txt 텍스트에 추가하세요. 형식에 유의하세요: http://127.0.0.1 한 줄에 하나씩 Cheeetah를 열고 실행하면 됩니다...

SECURITY-3314-3315

= SECURITY-3314/SECURITY-3315 완화 조치 이 저장소는 영향을 받는 인스턴스에서 SECURITY-3314 및 SECURITY-3315의 악용을 방지하는 완화 조치를 문서화합니다. == 개요 CLI에 대한 접근을 비활성화해야 합니다. 다음 두 단계를 모두 수행해야 합니다: CLI HTTP 엔드포인트 제거 SSH 포트 비활성화 https://plugins.jenkins.io/sshd/SSH Server Plugin NOTE 리모팅 기반 CLI는...

CVE-2026-23744

CVE-2026-23744 – 概念実証（PoC） このPoC内のPythonスクリプトは、MCPJam inspector（バージョン リスニングポートに置き換えてください 次に、別のシェルを開いてPoCを実行します: cd CVE-2026-23744 python3 exploit.py 参照 MCPJam inspectorのHTTPエンドポイント公開によるRCE GHSA-232v-j27c-5pp6 MCPJam/inspector@e6b9cf9 https://nvd.nist.gov/vuln/detail/CVE-2026-23744 免責事項...

CVE-2025-24893

CVE-2025-24893 Uso python CVE-2025-24893 http://target.com...

CVE-2024-1561

CVE-2024-1561 - Gradio 任意ファイル読み取り CVE-2024-1561 は、Gradio の バージョン 4.13.0 未満 に影響する任意ファイル読み取りの脆弱性です。Gradio は、機械学習モデルや AI アプリケーション向けの Web インターフェースを迅速に構築するために使用される人気の Python フレームワークです。 この脆弱性は、/componentserver エンドポイントが内部の Component クラスのどのメソッドを呼び出せるかを適切に制限していないために存在します。攻撃者はこの動作を悪用して、HTTP...

CVE-2026-46453

camel-elasticsearch-rest-client 接頭辞なしヘッダインジェクション再現器 CVE-2026-46453 このプロジェクトは、Apache Camelのcamel-elasticsearch-rest-clientコンポーネントにおけるメッセージヘッダインジェクション / 認可バイパス の脆弱性（CVE-2026-46453...

CVE-2019-3929

CVE-2019-3929 Crestron/Barco/Extron/InFocus/TeqAV 원격 명령 삽입 CVE-2019-3929 Metasploit 모듈 Tenable의 설명에 따르면: 인증되지 않은 원격 공격자는 HTTP 엔드포인트 filetransfer.cgi에 조작된 요청을 전송하여 루트 권한으로 운영 체제 명령을 실행할 수 있습니다. 이 취약점은 알려진 모든 장치에 영향을 미치는 것으로 보입니다. 여기에는 Crestron AM-100 펌웨어 1.6.0.2, Crestron AM-101 펌웨어 2.7.0.1, Barco...

CVE-2021-37832

CVE-2021-37832 CVE 2021-37832 poc 사용법 : python3 CVE-2021-37832.py http://test.com...

EUVD-2026-86320

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect...

GHSA-3R68-HF9H-887V MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

CVE-2026-61568

@zereight/mcp-gitlab, a Model Context Protocol server for GitLab, is affected in versions prior to 2.1.30 . The Streamable HTTP MCP endpoint lacks an effective Host or Origin allowlist , allowing a malicious web page to exploit DNS rebinding to route browser requests to a victim's local MCP liste...

EUVD-2026-78660

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

EUVD-2026-78785

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

PT-2026-93183

Name of the Vulnerable Software and Affected Versions mySCADA myPRO Manager affected versions not specified Description The notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages via a connected GSM modem. Because the endpoint is accessible over the network and...

EUVD-2026-74270

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

EUVD-2026-71612

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...