CVE-2026-67401

CVE-2026-67401 cPanel EmailTrack 中的 SQL 注入漏洞。拥有邮件权限的已认证 cPanel 用户可通过 SQLite ATTACH DATABASE 以 root 身份写入任意文件。一次请求即可获得 root 权限。尚未在真实目标上测试，代码仅根据公开信息和基础 diff 对比拼凑而成。请作为研究人员自行尽职验证，尝试运行并提交 PR 修复。 影响 2026 年 9 月 8 日补丁之前的所有 cPanel/WHM 版本。 所需条件 目标服务器上拥有邮件权限的有效 cPanel 账户 Python 3、requests 库 若使用反弹 Shell...

CVE-2026-50180 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses...

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Summary It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement. PoC js // poc.js import DatabaseSync from "node:sqlite" const db = new DatabaseSync":memory:"; db.exec"ATTACH DATABASE 'test.db' as test;"; db.exec"CREATE TABLE test.test id INTEGER PRIMARY KE...