CVE-2025-24893

XWiki CVE-2025-24893 概念验证 作者 : Net.Doge & Infinit3i 该Python脚本利用CVE-2025-24893 漏洞——XWiki因异步渲染Groovy宏时沙箱机制不完善导致的远程代码执行RCE漏洞。它通过向基于RSS的SolrSearch端点注入代码，实现任意命令执行。 📌 功能特性 通过Groovy注入执行单条命令 自动生成反向Shell载荷（配合msfvenom） 可自定义选项： 远程目标 本地IP地址 HTTP服务器端口 反向Shell信标端口 清晰的bash载荷预览 带ANSI颜色编码的交互式TUI 🚀 使用方法 1. 克隆或下载脚本...

EUVD-2020-21389

Malware in sbrugna...

CVE-2025-54782 @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

CVE-2022-24897 Arbitrary filesystem write access from Velocity

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...

TIBCO tibbr Multiple Vulnerabilities

TIBCO tibbr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tibco:tibbr"; if description...