CVE-2025-8110-Gogs-Remote-Code-Execution

影響を受けるソフトウェア: Gogs セルフホスト型Gitサービス バージョン0.13.0未満。 脆弱性の種類: Gitフックメカニズムにおけるコマンドインジェクション。 説明: リポジトリへのプッシュアクセス権を持つ攻撃者は、悪意のあるGitフックを作成し、post-receiveフックスクリプトにコマンドを注入することで、Gogsサーバー上でリモートコード実行を引き起こす可能性があります。...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — リモートコード実行に至るブラインドSQLインジェクション Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 脆弱性の概要 CVE-2026-57517 は、Control Web Panel CWP バージョン ≤ 0.9.8.1224 における、認証前の重大なブラインドSQLインジェクションです。ユーザーパネルのエンドポイントにある userRes...

CVE-2024-40498

CVE-2024-40498 영향을 받는 애플리케이션 online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced 설명 파일 register.php는 사용자 등록을 처리합니다. 117번째 줄에서 POST 매개변수 "$address1" 및 $address2"는 이메일, 이름 및 번호와 달리 검증되지 않아 VALUES 문 평가 중 SQL 인젝션이 발생합니다. 취약점을 악용하려면 "register.php" 파일에...

lab-cve-2016-15042

CVE-2016-15042 – WordPress Frontend File Manager 및 N‑Media Post Front‑end Form 인증되지 않은 파일 업로드 PoC Lab 완전히 재현 가능하며, CVE-2016-15042를 검증하고 시연하기 위한 Docker화된 연구실입니다. Frontend File Manager nmedia-user-file-uploader v3.7 취약 버전 4.0 N‑Media Post Front‑end Form wp-post-frontend v1.0 취약 버전 1.1 이 저장소는 원클릭 설정...

EUVD-2026-92043

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

PQCrypto-LWEKE

FrodoKEM: Learning with Errors 鍵カプセル化 このCライブラリは、よく研究されたLearning with Errors LWE 問題 1,3 に基づくIND-CCA安全な鍵カプセル化 KEM プロトコルである FrodoKEM を実装しています。LWE問題は、汎用的で「代数的に非構造化された」格子に関する困難性が予想される問題と密接な関係があります。このパッケージにはPythonリファレンス実装も含まれています。FrodoKEM は、量子コンピュータ攻撃に対しても安全であると予想されています。 FrodoKEM は、主に2つのバリアントで構成されています:...

CVE-2026-82286-gpt-crawler-Arbitrary-File-Write

CVE-2026-82286 — gpt-crawler 認証なし任意ファイル書き込み BuilderIO/gpt-crawler（約22k ★）における、POST /crawl API エンドポイントの outputFileName パラメータを介した認証なし任意ファイル書き込み の概念実証です。 | ---|--- CVE| CVE-2026-82286 製品| gpt-crawler BuilderIO 影響を受けるバージョン| $config.outputFileName.replace/.json$/, ""-$fileCounter.json; ... await...

CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123: Unrestricted Upload of File with Dangerous Type

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 5.0.12 AND time-based blind query SLEEP Payload: action=mylikesdislikesaction&post=1 AND SELECT 7318 FROM SELECTSLEEP5OIPg&state=dislike ---...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-102261

CVE-2026-102261 このプロジェクトには、認可されたCamaleon CMSインスタンスがバージョン2.9.3で導入された認可を適用しているかどうかを確認するための非破壊的 な検証ツールが含まれています。 スコープ この問題は、Camaleon CMS 2.9.2以前のPOST /admin/media/cropに影響します。:manage, :mediaを持つが:manage,...

CVE-2025-54782

기본 사용법： 2. 사용 bash python posttest.py urls.txt 3. 사용자 정의 명령： 4. 명령 bash python posttest.py urls.txt -c "whoami" python posttest.py urls.txt -c "ls -la /tmp" python posttest.py urls.txt -c "cat /etc/passwd" 5. 스레드 수 지정： bash python posttest.py urls.txt -c "id" -t 10 📁 URL 파일 형식（urls.txt）： text...

Block-Spring4Shell

Project Spring4Shell CVE-2022-22965 Blocker Firewall Server Handler - This project is a proof-of-concept POC firewall server designed to detect and block attacks exploiting the CVE-2022-22965 vulnerability, commonly known as Spring4Shell. The server inspects incoming HTTP requests and blocks any...

CVE-2025-49113

CVE-2025-49113 Roundcube ≤ 1.6.10 인증 후 RCE via PHP 객체 역직렬화...

CVE-2025-55182

CVE-2025-55182 Proof of concept exploit for CVE-2025-55182. When successful, it will emulate a shell on the remote target over HTTP-POST requests. Works with both HTTP and HTTPS, but skips any certificate checks. Only supports directory changes with absolute paths. How to use 1. Set up the...