CVE-2025-24893-PoC

CVE-2025-24893 - XWiki Удаленное выполнение кода RCE Обновленный эксплойт proof-of-concept PoC для CVE-2025-24893 , критической уязвимости RCE без аутентификации в XWiki. Эта версия улучшает оригинал, позволяя выполнение произвольных команд оболочки и чистую инъекцию обратной оболочки. Автор:...

cve-2023-1671

Сve-2023-1671 How does cve-2023-1671https://vulners.com/cve/CVE-2023-1671 work? /opt/ws/bin/ftsblistpack은 /opt/ws/bin/sblistpack을 호출하는 Perl 스크립트입니다. sblistpack 역시 Perl 스크립트입니다. 셸 명령 인자는 작은따옴표로 묶여 있습니다: root@kitploit: $rc += system"$sblistpack '$uri' '$user' '$filetype' '$filein' '$fileout'"; 이것은...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE 익스플로잇 스캐너 CVE-2025-3248 이 Python 기반 스캐너는 CVE-2025-3248 을 통해 Langflow 인스턴스에서 인증되지 않은 원격 코드 실행RCE 취약점 탐지를 자동화합니다. /api/v1/validate/code 엔드포인트를 악용하여 임의의 셸 명령을 실행하는 개념 증명PoC 페이로드를 사용합니다. 🚨 CVE 세부 정보 CVE : CVE-2025-3248 영향 : 인증되지 않은 원격 코드 실행 구성 요소 : Langflow API /api/v1/validate/code...

CVE-2023-46604

CVE-2023-46604 01. Apache ActiveMQ и OpenWire 1 Обзор Apache ActiveMQ и OpenWire ActiveMQ — это брокер, поддерживающий JMS и позволяющий осуществлять связь между системами, использующими не только Java, но и различные другие языки. Кроме того, это сервер с открытым исходным кодом для обмена...

CVE-2024-4358

CVE-2024-4358 Инструмент для обнаружения и массовой эксплуатации уязвимости CVE-2024-4358 Установка: root@kitploit: git clone https://github.com/RevoltSecurities/CVE-2024-4358 pip install -r requirements.txt python3 exploit.py --help Использование: root@kitploit: python3 exploit.py -h / / / / / /...

cve-2025-49844

CVE-2025-49844 これは CVE-2025-49844 の個人的な proof-of-concept であり、RediShell としても知られています。 対応ターゲットビルド: x86-64 Linux redis:8.2.1-alpine Docker イメージ x86-64 Linux redis:8.2.1-bookworm Docker イメージ 少し不格好で、Wiz Research のものほど良くはないかもしれません。それでも、Hexacon 2025 のトークがアップロードされる前に動かせたのは嬉しいですし、調査はとても楽しかったです。 使い方...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

PT-2026-85547

Name of the Vulnerable Software and Affected Versions goose versions prior to 1.38.0 Description The software executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. This occurs because the recipe security scan skips these two fields, allowing...

Astra Linux – Vulnerability in snmptt

Before version 1.4.2 of SNMPTT, attackers could execute shell code through EXEC, PREXEC, or unknowntrapexec...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-63046

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...

PT-2026-79344

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An argument injection issue exists in the Agent Installer's ModuleManager. The system executes arbitrary shell commands through the ExcuteLinux.exeCmd function because it lacks proper...

CVE-2026-18482 CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

ALPINE-CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

Vim's s:NetrwMarkFile() function in runtime/pack/dist/opt/netrw/autoload/netrw.vim interpolates a directory-listing filename directly into a filter() expression string ('v:val != "'.dname.'"'). A crafted filename with a double quote breaks the literal, allowing arbitrary Vimscript and shell execu...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...