CVE-2025-49113-Simulation

Roundcube RCE 실습 환경 CVE-2025-49113 Roundcube Webmail에서 식별된 중요한 인증 후 RCE 취약점CVE-2025-49113을 시뮬레이션하고 익스플로잇하기 위한 실습형 컨테이너 기반 실습 환경입니다. 📖 취약점 정보 이 실습은 Roundcube 웹메일 클라이언트를 대상으로 하는 정교한 공격 체인을 보여줍니다. 이 취약점은 인증 후 원격 코드 실행RCE 으로, PHP 세션 데이터의 부적절한 처리로 인해 발생하며 PHP 객체 역직렬화 로 이어집니다. 인증된 공격자는 악성 PHP 객체를 제작하여...

CVE-2026-42782 Apache Syncope: Post-auth RCE via Groovy static

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This issue affects...

EUVD-2023-52889

Malicious code in bioql PyPI...

CVE-2021-21247

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener AbstractPostAjaxBehavior in all pages other than the login page. This listener decodes and deserializes the data query parameter. We can access this listener by...

CVE-2023-48860

TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code...

CVE-2023-48859

TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code...

CVE-2023-48859: Incorrect Authorization

TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code...