481061 matches found
CVE-2025-59528
CVE-2025-59528: Flowise CustomMCP 远程代码执行 PoC 一个针对 CVE-2025-59528 的 Go 语言概念验证，影响 Flowise 版本 示例...
CVE-2026-82922
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...
CVE-2026-77353
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-82971 QVidium Opera11 CGI Script net_tr.cgi command injection
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...
CVE-2026-82971
A command injection vulnerability in QVidium Opera11 3.3.2a26-Ax4x-opera11 affects the CGI script /cgi-bin/net_tr.cgi , where manipulation of the ipaddr argument allows remote, unauthenticated attackers to execute arbitrary commands. The vulnerability is rated CVSS 10.0 (Critical) with low attack...
CVE-2026-78329
CVE-2026-78329 — camel-undertow 标头过滤策略未应用（websocket. 注入） 针对 Apache Camel 漏洞的可运行概念验证复现程序，该漏洞中 UndertowEndpoint 将 headerFilterStrategy 默认为基础 HttpHeaderFilterStrategy，并将该实例推入其创建的 UndertowHttpBinding 中，覆盖 了 DefaultUndertowHttpBinding 安装的 UndertowHeaderFilterStrategy。除非 部署提供了自定义绑定或显式的...
CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event
CVE-2026-22015 – 通过事件注入无服务器函数环境变量 程序代码（Python Lambda 模拟） root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environment variable overrides debug feature for key, value in event.get'env', .items:...
wp2shell-rce
WP2Shell RCE 一款评估与扫描工具，旨在检测单个端点或大型目标列表中的 WordPress Core 安装是否暴露于 WP2Shell 漏洞利用链。 ⚠️ 免责声明 仅可扫描您拥有或获授权评估的系统。 未经授权扫描或测试第三方系统属违法行为。维护者不对未经授权的使用或由此工具造成的间接损害承担任何责任或义务。 漏洞概述 WP2Shell 是一条严重的预身份验证远程代码执行（RCE）漏洞利用链，影响默认的 WordPress Core 安装，无需插件依赖或身份验证。 属性| 值 ---|--- 影响| 预身份验证远程代码执行（RCE） CVE 标识符| CVE-2026-63030...
CVE-2026-82922 ShopEx ECShop flow.php flow_update_cart sql injection
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...
CVE-2026-82922
ShopEx ECShop versions up to 2.5.1 are affected by a remote SQL injection in the function flow_update_cart within the file /flow.php?step=update_cart. The vulnerability is triggered by manipulating the rec_id argument, allowing an unauthenticated attacker to inject SQL over the network with no us...
CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-77353
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0 , authenticated users could inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. The root cause is that the input...
CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-82914
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-82221
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82226
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-81763
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...