Mailcow-CVE-2022-31245

Mailcow CVE-2022-31245 CVE-2022-31245: RCE y escalada de privilegios de Domain Admin para Mailcow. Incluyendo POC. Reportado y corregido: 2022-05 Versión parcheada: https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d CVE: https://vulners.com/cve/CVE-2022-31245 CVE-2022-31245:...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 Mailcow 的 RCE 和域管理员权限提升。针对 CVE-2022-31245 的 POC 可修改后适用于此漏洞。 报告并修复时间：2022-06 代码注入，RCE 类型：代码注入 CWE-94，RCE，域名接管 受影响版本：至少 2019 - 2022-06a 所有较新的 Mailcow 版本中存在一个缺陷，系统普通用户可利用“同步任务”功能，通过向 imapsync 中的任意正则表达式字段注入 Perl 代码来获取 shell。利用此漏洞，攻击者可以轻松转向数据库，并在 Mailcow 中将权限提升至“域管理员”。...

CVE-2023-2636

CVE-2023-2636...

CVE-2021-44228-Apache-Log4j

CVE-2021-44228 Ejecución Remota de Código en Apache Log4j Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.12.1 y desde 2.13.0 hasta 2.15.0 Avisos / Boletines de seguridad vinculados a Log4Shell CVE-2021-44228 Uso: 1. Descargue el proyecto y compile InjectClazz.java root@kitploit:...

drupalgeddon2

drupalgeddon2 针对 CVE-2018-7600 的漏洞利用工具。 用法：drupalgeddon2 options root@kitploit: -h：URL 目标 -c：操作系统命令 示例： drupalgeddon2.py -h http://www.victim.com -c 'ls -la' 基于 https://github.com/FireFart/CVE-2018-7600...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Debug Server

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-16826, CVE-2026-17499, CVE-2026-17273, CVE-2026-17259, CVE-2026-18076, CVE-2026-17274, CVE-2026-17270, CVE-2026-18073 in Debug Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16826...

SUSE CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

cve-2020-24572

CVE-2020-24572 Se descubrió un problema en includes/webconsole.php en RaspAP 2.5. Con acceso autenticado, un atacante puede utilizar una consola web mal configurada y prácticamente sin restricciones para atacar el sistema operativo subyacente que ejecuta este software, y ejecutar comandos en el...

EUVD-2026-68912

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

EUVD-2026-68911

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

EUVD-2026-68893

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2026-74251

Inyección SQL no autenticada a través del filtro de atributos en Phoca Cart Phoca Cart ≤ 6.1.6 — Un atacante no autenticado extrae la base de datos completa mediante inyección ciega basada en tiempo RESUMEN Los parámetros de matriz GET a atributo y s especificación en la página pública de artícul...

PT-2026-84165

Name of the Vulnerable Software and Affected Versions ArmorStart® LT affected versions not specified Description Multiple stored cross-site scripting issues exist. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious...

PT-2026-84274

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier Description The Document.createEntityReferencename function accepts invalid names, and the ENTITY REFERENCE NODE serializer emits...

VulnCheck KEV: CVE-2026-78141

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-51974

CVE-2026-51974 is an eval() injection vulnerability in the get_list function of modules/meta_parser.py in lllyasviel Fooocus versions 2.1.854 through 2.5.5 . A remote attacker with low privileges can craft a "styles" payload in the EXIF metadata of an uploaded image file, causing the application ...

PT-2026-84136

Name of the Vulnerable Software and Affected Versions yast2-samba-client versions prior to 5.0.5 Description Improper neutralization of special elements used in an OS command allows an attacker to execute arbitrary commands as root on a machine being joined to a domain. This occurs when the...

PT-2026-84315

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

PT-2026-84297

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An authenticated user with limited privileges can exploit a command injection flaw to execute arbitrary commands with root privileges. Command injection is a security issue where an...