270243 matches found
CVE-2025-60787
CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 원본 링크: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter 클라이언트 측 검증 우회를 통한 MotionEye RCE 요약 Docker에서 실행 중인 MotionEye 인스턴스의 보안 테스트 중 웹 UI 내 클라이언트 측 검증이 우회될 수 있음을 확인했습니다. 이를 통해 호스트 컨테이너에서 실행을 트리거할 수 있는 페이로드를 포함한 임...
CVE-2026-6960
CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 인증되지 않은 임의 파일 업로드 연구: Atomic Edge 심각도: Critical | CVSS: 9.8 | 인증 필요: 없음 ⚠️ v2 — 기술적 수정 적용 커뮤니티 피드백 반영 자세한 내용은 변경 로그를 참조하세요. 개요 BookingPress Pro WordPress 플러그인버전 ≤ 5.6에 중요한 인증되지 않은 임의 파일 업로드 취약점이 존재합니다. 예약 제출 핸들러 bookingpressbookappointmentbooking은 서명 사용자 정의...
cve-2025-53770-research
cve-2025-53770-research 🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day CVE-2025-53770. 🕵️♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️ 🕵️ CVE-2025-53770 — SharePoint "ToolShell" ゼロデイ調査...
cve-2019-13132-lab
CVE-2019-13132 — libzmq CURVE INITIATE スタックオーバーフロー → RCE ラボ CVE-2019-13132 に対する、エンドツーエンドで実際に動作する RCE エクスプロイト + 再現可能なラボです。これは libzmq の CURVE INITIATE ハンドシェイクハンドラにおけるスタックバッファオーバーフローです。サーバーの長期公開鍵（設計上公開されるパラメータ）を知っている攻撃者は、processinitiate 内の固定サイズのスタックバッファをオーバーフローさせ、保存された戻りアドレスを上書きし、実行を任意のコードにリダイレクトできま...
CVE-2026-35196
CVE-2026-35196 · Chamilo LMS · OS 명령 삽입 → RCE 연구자: K 공개 유형: 책임 있는 공개 상태: 패치됨 영향받는 제품: Chamilo LMS 2.0 v1.11.32에서 확인됨...
EUVD-2026-68800
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
CVE-2026-76595
A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...
CVE-2026-0770
CVE-2026-0770: Langflow execglobals 인증되지 않은 원격 코드 실행 PoC CVE-2026-0770 는 Langflow에 영향을 미치는 인증되지 않은 원격 코드 실행RCE 취약점입니다. 이 결함은 /validate 엔드포인트에 제공된 execglobals 매개변수 처리 중 부적절한 입력 검증으로 인해 발생합니다. 이를 악용하여 공격자는 검증 루틴 중 신뢰할 수 없는 전역 환경을 전달할 수 있으며, root 사용자 컨텍스트에서 원격 코드 실행을 달성합니다. ! 면책 조항 경고: 이 도구는 승인된 보안...
-Limesurvey-RCE-CVE-2021-44967
🚀 LimeSurvey RCE CVE-2021-44967 - Авторизованное удаленное выполнение кода Этот репозиторий содержит функциональный эксплойт для CVE-2021-44967 — уязвимости авторизованного удаленного выполнения кода в LimeSurvey. 🎯 Совместимость Протестировано и подтверждена работа на: LimeSurvey 5.2.x LimeSurve...
CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...
CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...
CVE-2026-77009
CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...
CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
EUVD-2026-70033
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
CVE-2026-10821
Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...
CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
CVE-2025-24893
정보 이 PoC는 먼저 SSTI를 테스트하고 작동하는지 확인합니다. 루프로 전환되어 원격으로 명령을 실행할 수 있게 해줍니다. 현재 exec와 shell 명령은 동일하게 동작합니다. 사용법 연결 root@kitploit: python3 poc.py 예시 debug를 False기본값로 설정한 경우 root@kitploit: python3 poc.py http://127.0.0.1:8080 Targeting http://127.0.0.1:8080 + Target is vulnerable! xwiki-shell help...