CVE-2025-9074

CVE-2025-9074 - Docker Remote API إثبات مفهوم مخبري ⚠️ إخلاء مسؤولية: هذا المستودع لأغراض تعليمية وبحثية فقط. لا تستخدم هذا الكود خارج بيئة خاضعة للسيطرة تمتلكها. المؤلف غير مسؤول عن أي إساءة استخدام. نظرة عامة يحتوي هذا المستودع على إثبات مفهوم PoC لثغرة CVE-2025-9074 ، وهي ثغرة سوء تكوين تتعلق ب...

CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Инструмент для выполнения команд в контейнерах Docker Мощный инструмент для эксплуатации удаленного API Docker, предназначенный для исследования безопасности и тестирования уязвимости CVE-2025-9074. Ключевые преимущества ✅ Полностью автоматизированное управление жизненным циклом...

CVE-langgraph

cve-id ⚡ الاستخدام البسيط استخدم هذا المشروع فقط في بيئات آمنة ومصرح بها مثل: الأجهزة الافتراضية المحلية حاويات Docker إعدادات المختبرات المعزولة بيئات اختبار الاختراق المصرح بها مثال على الإعداد: git clone cd Project use python follow below Create a virtual environment python -m venv venv Activa...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour هذا الكود لأغراض تعليمية فقط وبيئات خاضعة للرقابة مثل المختبرات Hack The Box. لا تستخدمه في أنظمة دون إذن. يحتوي هذا المستودع على سكربت استغلال لثغرة Docker Remote API المكشوفة بدون مصادقة والتي تسمح بالهروب من الحاوية إلى المضيف عن طريق إنشاء حاويات...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2021_4226)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214226 advisory. golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3114 grafana: snapshot feature allow an unauthenticated remote attacker to trigge...

CVE-2026-61518

A flaw was found in ISPConfig. A remote API user with low-privilege permissions can exploit an authenticated SQL injection vulnerability in the Remote API. This occurs because the primaryid parameter is directly used in SQL queries without proper validation. An attacker can leverage this to delet...

K000163050: Spring REST Docs vulnerability CVE-2026-40991

Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...

CVE-2026-61518

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

CVE-2026-61518

ISPConfig contains an authenticated SQL injection vulnerability in its Remote API . The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not ...

CVE-2026-61518 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

EUVD-2026-62663

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

CVE-2026-61518 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

PT-2026-78543

Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...

CVE-2026-61518: Improper Neutralization of Special Elements used in an SQL Command

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

CVE-2026-7726

The CVE describes an unauthenticated vulnerability in the WordPress plugin Layouts for WPBakery

CVE-2026-14602

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14602

The Remote API WordPress plugin (versions

CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14602: Improper Control of Generation of Code

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...