CVE-2025-32432

CVE-2025-32432 PoC de RCE sin autenticación en Craft CMS Ejecución remota de código crítica sin autenticación en Craft CMS Afectado: Craft CMS 3.x, 4.x y 5.x hasta 5.6.16 Info: Este exploit está probado contra la máquina Orion de HackTheBox Resumen Este repositorio contiene un exploit de prueba d...

CVE-2022-24990

CVE-2022-24990 Descripción - POC para CVE-2022-24990: Ejecución remota de comandos no autenticada en TerraMaster TOS mediante instanciación de objetos PHP. - creado por antx el 2022-04-12. Detalle - La vulnerabilidad permite a un atacante remoto ejecutar comandos arbitrarios en el sistema...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990 TerraMaster TOS RCE no autenticado mediante instanciación de objetos PHP Uso Detección de vulnerabilidad. root@kitploit: python CVE-2022-24990.py -u http://127.0.0.1:8080 Subir una webshell PHP. root@kitploit: python CVE-2022-24990.py -a http://127.0.0.1:8080...

CVE-2026-86730

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

EUVD-2026-72866

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

EUVD-2026-70113

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-83557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom...

PT-2026-84770

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

DEBIAN-CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

EUVD-2026-69250

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557

jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...

PT-2026-84291

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

BIT-JENKINS-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...