CVE-2023-1454-EXP

JeecgBoot SQL（CVE-2023-1454）exp 1.漏洞详情 jeecg-boot 3.5.0版本存在SQL注入漏洞，该漏洞源于文件 jmreport/qurestSql 存在安全问题， 通过参数 apiSelectId 导致SQL注入。 2.使用方法 root@kitploit: python3 CVE-2023-1454.py optional arguments: -h, --help show this help message and exit -u URL, --url URL Specify the base URL --current-db View...

CVE-2024-37742

CVE-2024-37742 재현 가이드: SEB ≤ 3.5.0 Windows에서의 클립보드 익스플로잇...

Fedora 43 : rsync (2026-d6763b4c84)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d6763b4c84 advisory. New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789...

Astra Linux – Vulnerability in JQuery

In jQuery, starting from version 1.12.0 and before 3.5.0, passing HTML from untrusted sources—even after sanitizing it—to one of jQuery’s DOM manipulation methods e.g., .html, .append, etc. may execute untrusted code. This issue has been fixed in jQuery 3.5.0...

Fedora 44 : rsync (2026-bfae8723e2)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bfae8723e2 advisory. New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789...

CVE-2026-70456 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70456 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70452 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70452 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70464 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70464 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70458 affecting package rsync for versions less than 3.5.0-1

CVE-2026-70458 affecting package rsync for versions less than 3.5.0-1. An upgraded version of the package is available that resolves this issue...

PT-2026-71636

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A privilege confusion issue exists in the name-converter subprocess uid/gid mapping. Local attackers can cause transferred files to be owned by root by influencing the name-converter responses to retur...

CLEANSTART-2026-OZ37229 Security fixes in fluent-operator-fips 3.5.0-r0

Package fluent-operator-fips version 3.5.0-r0 fixes 2 vulnerabilities: ghsa-9h8m-3fm2-qjrq, CVE-2026-24051...

CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is abl...

EUVD-2025-210451

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

CVE-2025-70796

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

CVE-2025-70796

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

CVE-2025-70796

An unauthenticated path traversal in the web management interface of WTI (Wireless Technology, Inc.), version 3.5.0.r 2024/05/24 00:00:00, allows crafted HTTP requests with traversal sequences to access files outside the web root, potentially disclosing sensitive system files and configuration da...

PYSEC-2026-1656 MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An...

VMware Spring Boot 信任管理问题漏洞

VMware Spring Boot is an open-source framework developed by the American company VMware. There are security vulnerabilities related to trust management in versions of VMware Spring Boot 4.0.0 to 4.0.6, 3.5.0 to 3.5.14, and 3.4.0 to 3.4.16. These vulnerabilities stem from the automatic email...

CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

NPM: claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

NPM: claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh vulnerability discovered by ? in WordPress Npm claude-code-cache-fix versions = 3.5.0, 3.5.2...