CVE-2023-33405

CVE-2023-33405 Open Redirection vulnerability identified on BlogEngine.NET CMS version 3.3.8.0 and earlier If a GET request to default.aspx page contains "years=" within the URL, the application calls a function named "Redirect". This function sets several parameters including year, month, date,...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Inyección de variables de entorno en funciones serverless a través del evento Código del programa simulación de Python Lambda root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environmen...

CVE-2026-63720-datamodel-code-generator

CVE-2026-63720：datamodel-code-generator 中因未经验证的 customBasePath 导致的代码注入 严重性： 高危，CVSS 3.1 7.5 / CVSS 4.0 7.5 （由 CNA VulnCheck 分配） 环境上限（网络服务部署）： 最高 9.8 向量（v4.0）： CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 向量（v3.1）： CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H 受影响版本：...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise 是一个拖放式用户界面，用于构建自定义的大语言模型流程。在 3.0.5 版本中，Flowise 存在远程代码执行漏洞。CustomMCP 节点允许用户输入用于连接外部 MCP 服务器的配置设置。该节点解析用户提供的 mcpServerConfig 字符串以构建 MCP 服务器配置。然而，在此过程中，它会在没有任何安全验证的情况下执行 JavaScript 代码。具体来说，在 convertToValidJSONString 函数内部，用户输入被直接传递给 Function 构造函数，该构造函数会将输入作为 JavaScript...

CVE-2024-21513

CVE-2024-21513 CVE-2024-21513 的概念验证（PoC） 漏洞利用原始文档由 Snyk 安全研究团队提供 漏洞利用 CVE-2024-21513 是 langchain-experimental 中的一个漏洞：未经验证的 SQL 查询结果被传递给 Python 的 eval 函数，从而通过基于 SQL 的输入注入实现远程代码执行。 PoC 结构 本 PoC 是一个极其基础的 Flask 应用，内嵌 HTML，用户可以在 SQLite 数据库中输入坐标。 如果用户在 y 值中输入恶意载荷，有漏洞的 LangChain-Experimental 功能会根据 x 值获取...

EUVD-2026-78837

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2022-36231

CVE-2022-36231 The ruby gem pdfinfo = 0.5.3 is vulnerable to OS Command Injection when executing a method on a PDF::Info object. An attacker using a specially crafted payload may execute OS commands by using command chaining. Vulnerability Analysis When creating a new PDF::Info object the...

CVE-2026-40564

CVE-2026-40564: SSRF a través de FlinkSessionJob.spec.job.jarURI en flink-kubernetes-operator El operador Apache Flink Kubernetes no verifica el campo spec.job.jarURI en los recursos FlinkSessionJob o FlinkDeployment. Cualquier persona que pueda crear uno de esos recursos puede establecer jarURI ...

HFS_EXPLOIT_PROJECT

HFSEXPLOITPROJECT 在 HFS 2.3 上使用 Metasploit 进行 RCE - CVE-2014-62 🔖 项目标题 root@kitploit: 通过 HTTP 文件服务器（HFS 2.3）进行远程代码执行 ⚙ 使用的工具 • Kali Linux • Nmap • Metasploit • 目标：Windows 7 上的 HFS 2.3 🔐 漏洞详情 • 名称：CVE-2014-6287 • 类型：远程代码执行 • 原因：HFS 脚本中未经验证的输入 • 影响：无需认证即可获得 shell 访问权限 🔍 方法论（分步操作） 🔹 步骤 1：信息收集（Nmap）...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE Mientras analizaba esta vulnerabilidad, descubrí que MCPJam Inspector exponía el endpoint /api/mcp/connect a la red vinculándose a 0.0.0.0. Este endpoint acepta un objeto JSON que contiene serverConfig, incluidos los campos command y args. La aplicación tenía la...

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

CVE-2026-81303

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-47256

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

EUVD-2026-77692

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-47256

The OpenTelemetry Collector Contrib Sentry exporter (prior to v0.154.0 ) interpolates the remote OTLP sender-controlled service.name resource attribute into Sentry API URLs without runtime validation. The projectSlugRegexp is applied only at config time, never to runtime-derived slugs. This allow...

CVE-2026-15923

The Zephyr SDIO subsystem function sdioiorwextendedhelper in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MINremaining, func-cis.maxblksize as the per-iteration step. The value func-cis.maxblksize is decoded directly from the SDIO card's CIS FUNCE tuple in sdiodecodec...

CVE-2026-21018

SveService 缓冲区溢出 Samsung SMR May 2026 SVE-2026-0478CVE-2026-21018 受影响版本：Android 14、15、16 披露状态：私下披露 SveService 在 SMR May-2026 Release 1 之前的版本中存在越界写入，允许本地特权攻击者执行任意代码。 该补丁添加了适当的输入验证。 警告：这是一个概念验证（PoC），仅供教育用途。对于任何非学习用途的行为，我概不负责。请知悉。 已在 Galaxy A17 LTE SM-A175F 上测试 英语 摘要 在运行 Android 16 的三星设备上，系统服务...