EUVD-2026-67844

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55565 Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

Nagios-CVE-2019-15949-RCE

Nagios-CVE-2019-15949-RCE-Poc un PoC Python per la CVE-2019-15949 Panoramica Esiste una vulnerabilità in Nagios XI = 5.6.5 che consente a un attaccante di sfruttare una RCE per elevare i privilegi a root. L'exploit richiede l'accesso al server come utente 'nagios', oppure l'accesso CCM tramite...

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Summary templateArgs sent to POST /api/instances and PATCH /api/instances/instance are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services:...

GHSA-73MF-M39P-WPM9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Summary templateArgs sent to POST /api/instances and PATCH /api/instances/instance are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services:...

CVE-2026-55559 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55559 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

EUVD-2026-67843

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55559

CVE-2026-55559 is a Critical (CVSS 9.8) remote code execution vulnerability in Yamcs (mission control framework) prior to versions 5.12.8 and 5.13.2 . The root cause is that templateArgs submitted via POST /api/instances or PATCH /api/instances/{instance} are appended into the rendered YAML confi...

exploits

Exploit Codice di exploit proof of concept vario scritto presso Xiphos Research per scopi di test. Exploit attuali l'indice potrebbe non essere aggiornato phpMoAdmin Esecuzione di codice remota CVE-2015-2208 LotusCMS Esecuzione di codice remota OSVDB-75095 ElasticSearch Esecuzione di codice remot...

Project-Exploiting-CVE-2024-27198-RCE-Vulnerability

Sfruttamento della vulnerabilità CVE-2024-27198-RCE In questo progetto, ho sfruttato la vulnerabilità CVE-2024-27198-RCE per eseguire un attacco di esecuzione remota di codice RCE su un server TeamCity vulnerabile. La vulnerabilità consente di caricare e attivare un plugin malevolo che fornisce...

cve-2025-48384-poc

PoC per CVE-2025-48384 Vedi CVE-2025-48384 Per eseguire: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules [email protected]:liamg/CVE-2025-48384.git Output di esempio: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test...

CVE-2026-60004

🚨 CVE-2026-60004 - RCE Esecuzione Remota di Codice Critica in Gitea tramite Git Hook diffpatch Una vulnerabilità critica di Esecuzione Remota di Codice RCE che consente l'esecuzione arbitraria di comandi tramite l'endpoint APIdiffpatch abusando dell'esecuzione dei Git hook. 📖 Panoramica...

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's...

GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...

OpenEMR_Vulnerabilities

Vulnerabilità di esecuzione di codice remoto in OpenEMR OpenEMR 5.0.1 consente a un utente autenticato di caricare ed eseguire codice PHP dannoso. PoC root@kitploit: git clone https://github.com/EmreOvunc/OpenEMRVulnerabilities.git cd OpenEMRVulnerabilities python3 openemrrcepoc.py -t...