CVE-2021-26086

CVE-2021-26086 Atlassian Jira Server/Data Center 8.4.0 - 受限远程文件读取/包含 受影响端点： root@kitploit: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.xml...

Scoold < 1.64.0 - Authentication Bypass

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...

CVE-2020-13933

CVE-2020-13933 靶场 shiro 1.6.0 身份认证绕过漏洞 PoC http://127.0.0.1:8080/res/%3bpoc 靶场环境 代码说明 ShiroConfig.java： 权限配置， 当请求 /res/ 资源时， 302 跳转到登陆页面进行身份认证 NameController.java： · /res/name： 请求名为 name 的的资源（触发身份认证） · /res/： 不请求任何资源（不触发身份认证） 靶场验证 不在请求路由中指定资源名称时，不触发身份验证，也无资源返回： http://127.0.0.1:8080/res/...

CVE-2026-3854-PoC

CVE-2026-3854 PoC — GitHub RCE via X-Stat Push Option Injection 仅用于教育和授权安全研究目的。 未经明确书面许可，请勿对任何系统使用。 概述 CVE-2026-3854 是 GitHub Enterprise Server（及 GitHub.com）git 推送管道中的一个远程代码执行漏洞。 当客户端提供推送选项（git push -o）时，GitHub 的内部 Ruby 代码会通过将每个选项值以分号作为字段分隔符拼接起来，构建一个 X-Stat 头。由于值被原样...

CVE-2023-36143

CVE-2023-36143 PoC de CVE-2023-36143 - Maxprint Maxlink 1200G v3.4.11E Inyección de Comandos Pasos para Reproducir: 1. Inicie sesión en el equipo a través de su navegador web 2. Vaya a la herramienta de diagnóstico 3. Inserte cualquier ip, por ejemplo 127.0.0.1, el carácter ; y un comando. 4...

CVE-2021-26085

CVE-2021-26085 Atlassian Confluence Server 7.5.1 预授权任意文件读取漏洞证明代码 POC 存在漏洞的端点： root@kitploit: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties...

PSTrojanFile

PSTrojanFile Windows PowerShell 文件名与 Defender 反恶意软件 API - 代码执行 POC 发现：John Page（又名 hyp3rlinx）2019 年发现，并于 2023 年重新审视 更新于 2023 年 12 月 24 日 绕过 PowerShell 中单引号的障碍实现代码执行，外加 PS Windows 事件日志失败！ 分号与搭档 "&" 运算符联手实现任意代码执行能力。 运行一些恶意软件： C:\Users\gg\Downloadspowershell get-filehash 'Infected.zip' -algorithm md...

CVE-2023-41080

有漏洞的：http://localhost:8081//secret.html;@example.com 重定向到任意网站（本例中为 https://example.com）。 已修补的：http://localhost:8082//secret.html;@example.com 参考：https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

PT-2026-89366

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Overview While conducting research into a recent N-able N-central authentication bypass vulnerability CVE-2026-18577, Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker ...

DEBIAN-CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0 , the client_params.sh script—invoked by the openNDS daemon to serve the authenticated client status page—is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embed...

CVE-2025-29278

CVE-2025-29278 Proof of Concept PoC: Nella scheda Diagnostica, vai allo strumento Tracert e, nel campo Host Address, inserisci un indirizzo IP valido seguito da un punto e virgola ; e il comando desiderato. Questa iniezione consente l'esecuzione arbitraria di comandi sul sistema. Esempio di...

Astra Linux – Vulnerability in python-django, python2.7

Packages containing “python/cpython” from versions 0 and earlier, including 3.6.13, 3.7.0 and earlier than 3.7.10, 3.8.0 and earlier than 3.8.8, 3.9.0 and earlier than 3.9.2, are vulnerable to Web Cache Poisoning via “urllib.parse.parseqsl” and “urllib.parse.parseqs”. This vulnerability occurs du...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforced its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...

Astra Linux – Vulnerability in python-bottle

Packages from versions 0 and before 0.12.19 are vulnerable to Web Cache Poisoning, due to a mechanism called “parameter cloaking”. When attackers can separate query parameters using a semicolon ;, they can create a discrepancy in the interpretation of requests between the proxy running with defau...

EUVD-2026-50416

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields...

CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...