CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE 在分析此漏洞时，我发现 MCPJam Inspector 将 /api/mcp/connect 端点绑定到 0.0.0.0，从而暴露在网络中。该端点接受一个包含 serverConfig 的 JSON 对象，其中包含 command 和 args 字段。 该应用旨在启动 MCP 服务器，但未能正确处理用户提供的值。因此，攻击者可以发送包含任意命令和参数的构造 HTTP 请求，这些请求随后会在服务器上执行，导致远程代码执行 RCE。 最有趣的是，漏洞利用载荷并非任意构造。通过使用 Burp Suite...

HFS_EXPLOIT_PROJECT

PROJETHFSEXPLOIT Metasploit RCE sur HFS 2.3 - CVE-2014-62 🔖 Titre du projet root@kitploit: Exécution de code à distance via HTTP File Server HFS 2.3 ⚙ Outils utilisés • Kali Linux • Nmap • Metasploit • Cible : HFS 2.3 sur Windows 7 🔐 Détails de la vulnérabilité • Nom : CVE-2014-6287 • Type :...

CVE-2026-40564

CVE-2026-40564: SSRF via FlinkSessionJob.spec.job.jarURI no flink-kubernetes-operator O Apache Flink Kubernetes Operator não verifica o campo spec.job.jarURI nos recursos FlinkSessionJob ou FlinkDeployment. Qualquer pessoa que possa criar um desses recursos pode definir jarURI para qualquer URL...

CVE-2025-3248

CVE-2025-3248 Exploit-Tool-Dokumentation Einleitung Dieses Tool dient der Ausnutzung der Schwachstelle CVE-2025-3248 eine Python-basierte Code-Injection-Sicherheitslücke, um durch die Konstruktion eines bösartigen Payloads eine Remote-Codeausführung RCE auf dem Zielserver zu erreichen. Die...

CVE-2018-1000533

ثغرة تنفيذ التعليمات البرمجية عن بُعد في GitList 0.6.0 CVE-2018-1000533 GitList هو عارض مستودعات Git حديث. في الإصدارات 0.6.0 وما دون من GitList، توجد ثغرة تتمثل في تمرير مدخلات لم يتم التحقق منها بشكل صحيح إلى دالة النظام، مما يسمح بتنفيذ أوامر عشوائية بصلاحيات مستخدم PHP. إعداد البيئة لتشغيل خا...

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Spring Boot Directory Traversal spring-boot-actuator-logview adiciona um visualizador simples de arquivos de log como um endpoint do actuator do Spring Boot em uma biblioteca. É o pacote maven "eu.hinsch:spring-boot-actuator-logview". Existe uma vulnerabilidade de...

CVE-2023-33405

CVE-2023-33405 Уязвимость открытого перенаправления, обнаруженная в BlogEngine.NET CMS версии 3.3.8.0 и более ранние Если GET-запрос к странице default.aspx содержит "years=" в URL, приложение вызывает функцию с именем "Redirect". Эта функция устанавливает несколько параметров, включая year, mont...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise è un'interfaccia utente drag & drop per creare un flusso personalizzato di modelli linguistici di grandi dimensioni. Nella versione 3.0.5, Flowise è vulnerabile all'esecuzione remota di codice. Il nodo CustomMCP consente agli utenti di inserire impostazioni di...

EUVD-2026-66222

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66559

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

CVE-2022-36231

CVE-2022-36231 La gemma Ruby pdfinfo = 0.5.3 è vulnerabile a OS Command Injection quando si esegue un metodo su un oggetto PDF::Info. Un attaccante utilizzando un payload appositamente creato può eseguire comandi del sistema operativo utilizzando il concatenamento di comandi. Analisi della...

GitLab-CVE-2021-22205-

Impacto da Vulnerabilidade Foi descoberto um problema no GitLab CE/EE que afeta todas as versões a partir de 11.9. O GitLab não estava validando corretamente os arquivos de imagem que eram passados para um analisador de arquivos, o que resultou em execução remota de comandos. Versões Afetadas...

CVE-2021-3262

CVE-2021-3262 SQL-Injection in TripSpark VEO Transportation / NovusEDU Die öffentliche Nachschlagseite „Student Busing Information", die mit TripSpark VEO Transportation ausgeliefert wird, nimmt nicht authentifizierte POST-Body-Eingaben entgegen und fügt sie ohne Parametrisierung oder serverseiti...

CVE-2024-21513

CVE-2024-21513 PoC per CVE-2024-21513 Exploit originale documentato da Snyk Security Research Exploit CVE-2024-21513 è una vulnerabilità in langchain-experimental in cui risultati di query SQL non validati venivano passati a eval di Python, consentendo l'esecuzione di codice remoto tramite...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Vulnerabilità di input non convalidato nel plugin Jenkins Git Parameter. Riepilogo Questa vulnerabilità nasce perché l'input controllato dall'utente nei parametri di build di Jenkins viene iniettato in modo non sicuro nel comando Git checkout. L'input dell'utente viene fornito com...

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

CVE-2026-79775

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-13216

CVE-2026-13216 is an out-of-bounds stack write in the Zephyr RTOS virtio PCI driver (drivers/virtio/virtio_pci.c). The device-supplied cap_len field, read from PCI config space, was validated only by a compiled-out assert() (gated by CONFIG_ASSERT, off by default in production). The unvalidated l...