CVE-2022-47986

CVE-2022-47986 Why This vulnerability is exploited in the wild. IceFire use this vulnerability to deploy the ransomware on targeted systems, i would like to help SOC/Blue teams to identify impacted systems and Pentesters/Red teams to exploit and report it. Description I propose pure python and ru...

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML Parsing Remote Code Execution Vulnerability Reproduction and Analysis Overview ShardingSphere is an open-source ecosystem under Apache, a set of distributed database middleware solutions composed of three independent frameworks: Sharding-JDBC,...

CVE-2013-0156

Riferimento allo Script Originale Per maggiori dettagli sullo script di exploit originale, fare riferimento al link gist CVE-2013-0156 Script di Exploit CVE-2013-0156 Questo script è progettato specificamente per risolvere la challenge su PentesterLab per l'exploit CVE-2013-0156. Puoi accedere al...

CVE-2022-31691

CVE-2022-31691 A write-up of my so far inconclusive look into CVE-2022-31691. Background I'm a frequent user of the Spring Tool Suite STS for Eclipse, and tend to rely on it to initialise new Spring Boot projects. This vulnerability see https://tanzu.vmware.com/security/cve-2022-31691 is an RCE...

CVE-2013-0156

Rails YAML deserialization RCE CVE-2013-0156 - PentesterLab Compatible Ronin-free, Ruby 3.x compatible version of https://gist.github.com/postmodern/4499206 Usage: ruby railsrce.rb http://target/ "system'/usr/local/bin/score UUID'" ⚠️ LEGAL DISCLAIMER ⚠️ This script is for EDUCATIONAL PURPOSES ONLY...

CVE-2026-76461

CVE-2026-76461 Un laboratorio Python intenzionalmente vulnerabile, solo locale, per imparare come una deserializzazione YAML non sicura possa diventare un percorso di esecuzione di codice. Include tre livelli di difficoltà, un'app di confronto con patch, script di exploit, suggerimenti, write-up ...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2025-56815

CVE-2025-56815 Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo to save the uploaded file to a path controllable by the user, and lacks strict verification of the filename. POST...

CVE-2021-41078

CVE-2021-41078 nameko Arbitrary code execution due to YAML deserialization NVD Description Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. Demo Set Up 1. Build an image from a Dockerfile docker build -t cve-2021-41078 . 2. Run pyth...

Exploit for SQL Injection in Cisco Asyncos

CVE-2026-76461 Vulnerability Exercise This project contains a...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

CVE-2026-76594

A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

Arbitrary Code Injection

Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...