CVE-2023-20198

CVE-2023-20198 Un script de explotación desarrollado para explotar la vulnerabilidad de día cero CVE-2023-20198 de Cisco en su IOS XE Los hackers han estado explotando ampliamente esta vulnerabilidad que crea un usuario con privilegios de nivel 15 al omitir la autenticación. Un contenido XML...

CVE-2020-26217-XStream

CVE-2020-26217 XStream RCE Exploit Herramienta de explotación de la vulnerabilidad de ejecución remota de código en XStream. Descripción de la vulnerabilidad CVE-2020-26217 es una vulnerabilidad de deserialización en la librería XStream que permite a un atacante ejecutar código remoto mediante la...

CVE-2023-46604-ActiveMQ-RCE-pseudoshell

CVE-2023-46604 RCE 伪终端 该脚本利用 CVE-2023-46604（Apache ActiveMQ）生成一个伪终端。该漏洞源于 OpenWire 协议中的不安全反序列化，可实现远程代码执行。 描述 CVE-2023-46604 是 Apache ActiveMQ 的 OpenWire 协议中存在的一个反序列化漏洞。攻击者可利用该缺陷在运行 ActiveMQ 的服务器上执行任意代码。攻击者可以构造一个恶意 XML 文件，远程服务器将执行其中的命令。 此漏洞利用工具自动化并简化了 XML 文档的创建过程，提供基础服务器来传输文件，并通过 POST...

jsonorg-tp1

json.org CVE-2022-45688 真阳性 该项目演示了 json.org 中的 CVE-2022-45688——有一个简单的应用程序 XML2JSONConverter 从输入读取 XML，将其转换为 JSON 并 美观打印到控制台。 使用恶意输入，应用程序会因栈溢出而崩溃。 测试用例 CVE202245688Test 演示了此行为，可以通过运行 mvn test 来执行。 运行软件组合分析 有多个 sh 脚本用于运行不同的分析，结果报告可在 scan-results 中找到。 生成 SBOM pom.xml 包含一个插件，用于生成 CycloneDX 格式的 SBOM。...

ActiveMQ-EXPtools

ActiveMQ-EXPtools Soporta la detección y explotación de vulnerabilidades de Apache ActiveMQ: CVE-2015-5254, CVE-2016-3088, CVE-2022-41678, CVE-2023-46604, CVE-2024-32114, CVE-2026-34197, CVE-2026-40466, CVE-2026-42588 !WARNING Esta herramienta es solo para fines de investigación y aprendizaje de...

DEBIAN-CVE-2026-56364

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...

CVE-2026-56364

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...

GHSA-5QF9-CF9C-HJC6 Routinator crashes when encountering maliciously crafted RRDP XML files

When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes...

Nmap 安全漏洞

Nmap is an open-source tool for network discovery and security scanning developed by Nmap. Version 7.70 of Nmap contains a security vulnerability. This vulnerability arises from handling malicious XML files containing exponentially growing entity extensions, which can lead to a denial-of-service...

OESA-2026-1917 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

A flaw was found in .NET. A remote attacker could exploit this vulnerability by crafting a malicious XML document that triggers an infinite recursion within the XmlDecryptionTransform component. This could lead to a Denial of Service DoS, making the affected system unresponsive...

CVE-2026-39367

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG Electronic Program Guide feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epglin...

CVE-2026-39367

WWBN AVideo (versions 26.0 and earlier) has a stored XSS vector in the EPG page. The EPG feature parses XML from user-controlled URLs and renders elements directly into HTML without sanitization, allowing a user with upload permission to point epg_link to a malicious XML to trigger JavaScript ex...

PT-2026-30986

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG Electronic Program Guide feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg li...

PT-2026-54043

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-13 Description A memory leak occurs in the LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files that contain unclosed device elements. An attacker with write access to th...

CVE-2018-25142

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity XXE injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack...

Malicious Package

Overview fruit-malicious-xml-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in fruit-malicious-xml-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c330d59c7529d320701e6ccf11a655110e1aeb7c9ad5d15c34ba10941c6343a6 The package fruit-malicious-xml-parser was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-202949

Malicious code in fruit-malicious-xml-parser npm...

MAL-2025-192550 Malicious code in fruit-malicious-xml-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c330d59c7529d320701e6ccf11a655110e1aeb7c9ad5d15c34ba10941c6343a6 The package fruit-malicious-xml-parser was found to contain malicious code. Source: ghsa-malware...