reproducing-CVE-2025-1489

复现 CVE-2025-1489 此仓库在安全环境中模拟了与 Web 相关的 CVE（CVE-2025-1489）的复现，以演示并练习我的取证/漏洞分析技能。 已识别并复现的漏洞是 WordPress 插件 WP-Appbox（版本 4.5.4）中的存储型跨站脚本（XSS）漏洞。由于对用户转义属性的输入清理和输出转义不足，攻击者控制的输入被放置在文章的 Appbox 短代码中，进而渲染到页面输出中，从而允许通过属性上下文执行恶意脚本。该漏洞在 WP-Appbox 的后续版本（4.5.5+）中已修复。 漏洞描述 该插件暴露了一个短代码 appbox ...，接受一个应用 ID appID...

CVE-2026-42208

✦ CVE-2026-42208 - Inyección SQL Crítica en LiteLLM 🧭 Resumen CVE-2026-42208 es una vulnerabilidad crítica de inyección SQL sin autenticación que afecta a la puerta de enlace de IA LiteLLM. Permite a los atacantes explotar consultas de base de datos del backend sin autenticación , exponiendo...

CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

EUVD-2026-68984

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-83772

Cobham SATCOM VSAT7090 Maritime Satellite Router versions up to 20260704 are affected by a command injection vulnerability in the JSON Parsing component. The root cause lies in the function c_set_reports_decode within the file mail-report.sh , where unsanitized manipulation of the sender/recipien...

EUVD-2026-68983

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189

The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...

cve-2024-43425

CVE-2024-43425 固件信息： 应用名称：Moodle 构建版本：moodle-4.4.1 受影响版本：4.4 至 4.4.1、4.3 至 4.3.5、4.2 至 4.2.8、4.1 至 4.1.11，以及之前不受支持的版本 下载链接：moodle-4.4.1 描述与影响 拥有在 Moodle 课程中创建或修改问题权限的攻击者，可以为计算题构造恶意输入，进而可能被滥用以在底层系统上执行任意命令。 根本原因 函数 qtypecalculatedfindformulaerrors 用于确保在 Moodle 中输入的公式的有效性，防止语法错误。 变量会被替换为数字...

CVE-2026-76006

The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-77823

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-18752

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-17589

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-19478-PoC

CVE-2026-19478 PoC GitLab GraphQL 层中的未认证远程代码注入 ，允许攻击者通过单个精心构造的查询修改或删除公共项目和用户数据 。无需认证，无需用户交互，无需特殊权限。 | ---|--- 严重性| 9.4 严重 — AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H CWE| CWE-94（对代码生成的控制不当 / 代码注入） 影响版本| GitLab CE/EE = 18.2, 18.11.11 · 19.0.8 · 19.1.6 · 19.2.4 修复版本| 18.11.11, 19.0.8, 19.1.6, 19.2.4 披露时间...

CVE-2024-55187

摘要 敏感的管理参数未得到充分清理，导致攻击者能够污染指向系统二进制文件的路径。 随后，攻击者可以上传危险的 CSV 文件，这些文件可被当作包含 shell 元字符的 PHAR 归档处理，并由 PHP 的 exec 调用执行，从而实现远程代码执行。 影响 服务器被接管 拒绝服务 数据丢失 CVSS 评分 严重 - 9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 详情 在文件 functions/classes/class.Scan.php 中，我们可以看到以下代码结构： exec 调用的第一个参数直接依赖于 $pingpath...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852：Instant Developer Foundation（ 25.0.9600）中的 CSV 注入 – 概念验证（PoC） 📌 概述 本仓库包含一个 CSV 注入（公式注入） 漏洞（CVE-2025-60852）的概念验证（PoC），该漏洞影响使用 Instant Developer Foundation 框架（25.0.9600 之前的版本）构建的应用程序。使用受影响框架构建的应用程序在导出 CSV 格式数据时，未正确清理用户提供的输入。 因此，Microsoft Excel 或 LibreOffice Calc 等电子表格软件会将某些值解释为公式。...

CVE-2025-7558-PoC

CVE-2025-7558-PoC 摘要 一个被标记为严重的漏洞存在于 code-projects Voting System 1.0 中。受影响的元素是文件 /admin/positionsadd.php 中的一个未知函数。对参数 Description 的操作导致了 SQL 注入。此漏洞被记录为 CVE-2025-7558。攻击可远程执行。此外，存在可利用的漏洞利用程序。 详情 在 code-projects Voting System 1.0 中发现了一个漏洞，并被归类为严重。受此问题影响的是文件 /admin/positionsadd.php 中的未知部分。对参数...

CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

EUVD-2026-68979

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-77823

The LearnPress WordPress plugin (versions ≤ 4.4.4 ) is vulnerable to SQL injection via the orderby parameter in the export_order_csv AJAX action. The root cause is insufficient escaping: only the literal values date and title are normalized, while any other attacker-controlled string is concatena...