34 matches found
CVE-2025-47812-poC
CVE-2025-47812-poC Exploit simple para Wing FTP Server RCE CVE-2025-47812 para ejecutar comandos y obtener una reverse shell. Solo para uso educativo. Detalles de la Vulnerabilidad Esta vulnerabilidad de seguridad fue divulgada y detallada públicamente por RCESecurity...
CVE-2025-47812
CVE-2025-47812 – Wing FTP Server RCE mediante Inyección de Lua Autor: 0xgh057r3c0n 🧠 Descripción Este exploit aprovecha una vulnerabilidad de inyección de Lua en el manejador de inicio de sesión loginok.html de Wing FTP Server para ejecutar comandos arbitrarios del sistema operativo u obtener una...
CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit
Wing FTP Server v8.1.2 contiene una vulnerabilidad de Ejecución Remota de Código RCE en el mecanismo de serialización de sesiones. Un administrador autenticado puede inyectar código Lua arbitrario a través del campo mydirectory basefolder del administrador de dominio, que se ejecuta del lado del...
CVE-2025-47812-Research
CVE-2025-47812 — Wing FTP Server RCE Research Context Cybersecurity observation internship carried out within the Akasec club 1337 Khouribga — July/August 2025. Vulnerability studied CVE : CVE-2025-47812 CVSS Score : 10.0 Critical Affected software : Wing FTP Server 7.4.4 Type : Remote Code...
CVE-2025-47812
CVE-2025-47812 – Wing FTP Server RCE Exploit Exploit Title: Wing FTP Server 7.4.4 Remote Code Execution via Lua Injection CVE: CVE-2025-47812 Tested on: Wing FTP Server v7.3.x Windows/Linux Impact: Remote Code Execution RCE as SYSTEM/root Severity: Critical Description A vulnerability in Wing FTP...
Blackash-CVE-2025-47812
🛡️ CVE-2025-47812 – Critical RCE in Wing FTP Server 🛡️ 🔎 Overview: CVE-2025-47812 is a critical remote code execution RCE vulnerability affecting Wing FTP Server versions prior to 7.4.4. It was discovered by a security researcher and has been confirmed to be actively exploited in the wild. 🧱 Root...
CVE-2023-5044
CVE-2023-5044 Inyección de código mediante nginx.ingress.kubernetes.io/permanent-redirect annotation Primero, necesitas desplegar un Pod y un Service: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: -...
CVE-2023-5043
CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution 1. Create Ingress can be created without Service and Pod apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-exploit annotations: kubernetes.io/ingress.class: "nginx"...
CVE-2025-47812
CVE-2025-47812 — Wing FTP Server RCE sin autenticación reescritura Exploit en Python para la RCE por inyección Lua no autenticada en Wing FTP Server ≤ 7.4.3. Diseñado para entrega de shell — un comando desde check hasta un callback netcat funcional. Escrito hace tiempo para el laboratorio wingDat...
SUSE CVE-2026-78367
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...
SUSE CVE-2026-41246
Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...
CVE-2026-44403
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server
CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python...
CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...
EUVD-2026-25280
Contour has Lua code injection via Cookie Path Rewrite Policy...
CVE-2026-41246
Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...
CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy
Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...
Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server
\ CVE-2025-47812 — Wing FTP Server RCE Research \ Contexte...