4619 matches found
CVE-2020-8165
CVE-2020-8165 Ruby on Rails 仅供教育目的使用。 详情请参阅参考。 环境 Ruby: 2.6.3 Rails: 5.2.3 运行 root@kitploit: $ git clone https://github.com/masahiro331/CVE-2020-8165.git $ bundle install --path vendor/bundle $ bundle exec rails db:migrate $ bundle exec rails s use redis $ docker run -d -p 6379:6379 redis 漏洞利用...
rails-cve-2017-17917
rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : root@kitploit: Ruby:...
CVE-2019-5418
CVE-2019-5418 Test case Run : root@kitploit: $ rails s PoC : root@kitploit: Accept: ../../../../../../../../etc/passwd Req 1 - root@kitploit: GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept:...
CVE-2026-66066-POC
PoC para CVE-2026-66066 - Laboratorio mínimo de stock Rails/libvips Este repositorio reproduce la cadena de lectura-de-archivo-a-RCE de Rails Active Storage descrita en GHSA-xr9x-r78c-5hrm contra Rails 8.1.3, la versión afectada más reciente de Rails 8.1. Rails 8.1.3.1 es el control parcheado...
CVE-2019-5418
CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...
lightweight_static_analysis
轻量级静态分析 本仓库包含 ShellCon 2019 演讲“Rolling Your Own: How to Write Custom, Lightweight Static Analysis Tools”的 PoC 代码（幻灯片）。 简而言之，本仓库演示了几个具体示例，展示如何使用开源工具和少量自定义代码构建一些有趣的静态分析。 本仓库中的代码示例 ： 1. 迭代式探索 Rails 代码库，以了解它所定义的控制器及其使用的 beforeaction。 2. 查找 NodeJS 应用中的命令注入。 这些示例的工作原理 从高层来看，示例的实现方式如下： 1. 找到你想要分析的源代码。 2...
CVE-2015-3224
Ruby on Rails Web Console Exploit CVE-2015-3224 This repository contains a Python script to exploit an IP whitelist bypass vulnerability in the developer web console of Ruby on Rails 4.0.x and 4.1.x. The script allows for remote code execution on vulnerable servers. ⚠️ Disclaimer This script is...
CVE-2018-3760
CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: root@kitploit: curl -v...
CVE-2016-2098
CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. Explanation: This issue comes from the usage of the render method on user-supplied data. The method render is usually used to render a page from a template, but render method also allows...
Rails-doubletap-RCE
Rails-doubletap-exploit RCE en Rails 5.2.2 mediante un path traversal CVE-2019-5418 y una deserialización de objetos Ruby CVE-2019-5420 Análisis técnico : CVE-2019-5418 - https://github.com/mpgn/CVE-2019-5418 CVE-2019-5420 - https://hackerone.com/reports/473888 Aviso de seguridad : CVE-2019-5418 ...
brakeman
Brakeman Brakeman 是一款静态分析工具，用于检查 Ruby on Rails 应用程序中的安全漏洞。 安装 使用 RubyGems： root@kitploit: gem install brakeman 使用 Bundler： root@kitploit: group :development do gem 'brakeman', require: false end 使用 Docker： root@kitploit: docker pull presidentbeef/brakeman 使用 Docker 从源码构建： root@kitploit: git clone...
CVE-2026-83619 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
GHSA-27P8-2357-5QQV vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
CVE-2026-83608 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
CVE-2026-83614 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
GHSA-8344-3JMQ-59R6 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
GHSA-93R5-FHX6-VMG9 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
CVE-2026-83615 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...