CVE-2026-74820

CVE-2026-74820 is a CRITICAL (CVSS 4.0: 10.0) SQL injection vulnerability in the ServiceNow AI platform , specifically through a Dynamic Schema ORDER BY clause . An unauthenticated user can, under certain circumstances, execute arbitrary SQL statements against the instance's underlying database, ...

EUVD-2026-67221

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

EUVD-2026-67220

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

CVE-2026-18886

CVE-2026-18886 is an improper access control vulnerability in the ServiceNow AI platform , specifically in the System Configuration Image Upload Processor . An unauthenticated user can, in certain circumstances, create or modify instance data beyond intended scope, leading to privilege escalation...

EUVD-2026-67219

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...

CVE-2026-18885

CVE-2026-18885 is a code injection vulnerability in the ServiceNow AI platform , specifically in its GraphQL Composite Data API , enabling an unauthenticated attacker to execute arbitrary code and access or modify instance data. The CVSS 4.0 base score is 10.0 (Critical) with all impact dimension...

EUVD-2026-67218

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. ServiceNow deployed a...

CVE-2026-6876

CVE-2026-6876 is a sandbox escape vulnerability in the ServiceNow Now Platform that allows an unauthenticated user to execute arbitrary code, potentially granting broader access to the platform than intended. The vulnerability is rated CVSS 4.0 8.7 (HIGH) with a network attack vector, low complex...

CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py è uno script Python progettato per rilevare specifiche vulnerabilità nelle istanze ServiceNow e scaricare i dettagli di connessione al database se la vulnerabilità viene trovata. Questo strumento è particolarmente utile per ricercatori di sicurezza e penetration...

CVE-2024-4879

Vulnerabilidade de Injeção de Template Jelly no ServiceNow | POC CVE-2024-4879 Descrição: O ServiceNow corrigiu uma vulnerabilidade de validação de entrada identificada nas versões Vancouver e Washington, D.C. do Now Platform. Esta vulnerabilidade poderia permitir que um usuário não autenticado...

CVE-2024-4879

CVE-2024-4879 Strumento di scansione di massa per la vulnerabilità ServiceNow CVE-2024-4879. Panoramica Questo strumento è progettato per la scansione di massa della vulnerabilità ServiceNow CVE-2024-4879. È ispirato alla ricerca di sicurezza di Assetnote, che copre in dettaglio le recenti...

ServiceNow - Cross-Site Scripting

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. id: CVE-2022-38463 info: name: ServiceNow - Cross-Site Scripting author: amanrawat...

ServiceNow - Cross-site Scripting

A XSS vulnerability was identified in the ServiceNow UI page assessmentredirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks,...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - Framework d'exploitation RCE sans authentification ServiceNow & Vérificateur de PoC 🔥 ServiceNow AI Platform — Injection JavaScript → Évasion de sandbox → RCE → Élévation de privilèges root Framework d'exploitation et Vérificateur sécurisé Pour les tests de sécurité autorisés...

CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning

CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning CVE-2024-4879 & CVE-2024-5217 ServiceNow RCE स्कैनिंग Nuclei और Shodan Dork का उपयोग करके इसे खोजने के लिए। संसाधन भेद्यता जानकारी https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data उपयोग nuclei -t...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

Script de Mitigação ServiceNow CVE-2025-11449 e CVE-2025-11450 Visão Geral Este script detecta e corrige automaticamente as vulnerabilidades de segurança CVE-2025-11449 e CVE-2025-11450 em UI Macros do ServiceNow. Essas vulnerabilidades podem permitir a execução arbitrária de código nos navegador...

snowpick

snowpick هو ماسح تعرضات ServiceNow يكتشف أخطاء الإعداد في قوائم التحكم في الوصول ACLs الخاصة بالويدجات، وعناصر التحكم في الوصول لواجهة REST API، والتعرض غير المصرح به للبيانات. يعرض ServiceNow البيانات عبر سطحين عامين شائعين: ليدجات Service Portal وواجهة Table REST API. عندما تكون عناصر التحكم في...

CVE-2024-4879

CVE-2024-4879 비즈니스 혁신을 위해 널리 사용되는 플랫폼인 ServiceNow는 최근 전 세계 조직에 심각한 영향을 미칠 수 있는 세 가지 중요한 보안 취약점을 공개했습니다. CVE-2024-4879, CVE-2024-5217 및 CVE-2024-5178로 식별된 이러한 취약점은 Now Platform의 다양한 버전에 영향을 미칩니다. 이 중 가장 우려되는 결함은 CVE-2024-4879와 CVE-2024-5217로, 각각 CVSSv4 점수 9.3과 9.2의 심각도를 가집니다. 이 취약점을 통해 인증되지 않은 원격...

CVE-2021-45901

CVE-2021-45901 ServiceNow - Benutzernamen-Enumeration PoC-Code enumSNOWUsers.py - SNOW-Benutzer-Enumerator Titel Benutzernamen-Enumeration-Schwachstelle in der ServiceNow-Anwendung gefunden Veröffentlicht: Version: 1.0 Anbieter: ServiceNow Produkt: ServiceNow https://www.servicenow.com/ Betroffen...

sh00t

root@kitploit: A Testing Environment for Manual Security Testers Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or...