https://rss.biu.life/ BiuPoC 漏洞情报平台，聚合最新 CVE、PoC、EXP 与漏洞复现资料，支持按软件产品与攻击路径检索，助力安全研究与攻防自查。 zh-CN 157646199064826880 76992525282223104 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29134.yaml TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-54391.yaml Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password "root@pam" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement and gaining full administrative access to the hypervisor management interface. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-51683.yaml mJobtime v15.7.2 contains a sql injection caused by crafted POST request to /Default.aspx/update_profile_Server, letting unauthenticated attackers execute arbitrary SQL statements remotely, exploit requires no special privileges. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57231.yaml Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0561.yaml Shield Security WordPress plugin <= 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0650.yaml OpenFlagr <= 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0702.yaml VidShop – Shoppable Videos for WooCommerce plugin for WordPress <= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0768.yaml Langflow <= 1.2.x exposes POST /api/v1/validate/code without any authentication. The endpoint calls validate_code() which exec()s user-supplied Python code. Default-argument expressions in Python execute at function-definition time, allowing arbitrary OS command execution without authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1281.yaml Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19092.yaml Tutor LMS WordPress plugin < 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19632.yaml TranslatePress WordPress plugin <= 3.3.1 contains a sensitive information exposure caused by the 'trp_get_translations_regular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string saving enabled and admin profile locale set to a published secondary language. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2113.yaml yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21875.yaml ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in /actions/ajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23693.yaml The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26265.yaml Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on user_field_ids parameter in DirectoryItemsController#index, letting any user retrieve private user field values, exploit requires no authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27454.yaml Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsController#display_post. The controller calls post.revert_to(params[:version]) directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is hidden or whether the caller has permission to view edit history. By requesting a post at its publicly known version number via GET /posts/:id.json?version=<public_version>, the next PostRevision's stored modifications are applied unconditionally. If staff have hidden that revision, its pre-edit content is returned to an unauthenticated caller. On patched installs the same request is rejected with 403 because guardian.ensure_can_see!(post_revision) is evaluated first. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28141.yaml NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28411.yaml WeGIA < 3.6.5 contains an authentication bypass caused by unsafe use of extract() on $_REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29962.yaml HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in /vendor/phpunit/phpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29963.yaml HSC MailInspector 5.3.3-7 contains a path traversal caused by improper validation of user-supplied input in /tap/dw.php text parameter, letting remote attackers access arbitrary files, exploit requires crafted request. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30849.yaml Mantis Bug Tracker < 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34234.yaml CtrlPanel versions <= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41452.yaml Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41456.yaml Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41679.yaml Paperclip < 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41948.yaml Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42221.yaml Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44343.yaml WGDashboard < 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48558.yaml SimpleHelp <= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53595.yaml FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5524.yaml The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the do_image_upload() AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By supplying acceptFileTypes=phtml the constructed regex accepts .phtml files while the plugin's .htaccess only blocks .php, so Apache executes .phtml files as PHP. The required nonce (fb_nonce) is publicly embedded in any page containing a Divi form via the de_fb_obj JavaScript object. Uploaded shells land in /wp-content/uploads/de_fb_uploads/. Fixed in 5.1.9. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-5562.yaml Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the `/api/smartfilters/testexecutions` endpoint. The `filterCode` parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system commands on the host. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56292.yaml AcyMailing component for Joomla <10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-57582.yaml GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58123.yaml Hermes WebUI < 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58191.yaml Appium <= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59177.yaml ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59509.yaml cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59726.yaml ruflo MCP bridge (< 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The blocklist (AUTOPILOT_BLOCKED_PATTERNS + isBlockedTool()) is enforced only in the autopilot SSE handler; POST /mcp and POST /mcp/:group bypass it entirely. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60105.yaml Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61736.yaml LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-62382.yaml PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass (CWE-863). The deletion guard evaluates (@push.user == current_user) || @push.deletable_by_viewer. For anonymous pushes, @push.user is nil; for unauthenticated requests, current_user is nil. Ruby evaluates nil==nil as true, so the ownership check passes and the deletable_by_viewer=false restriction is completely bypassed. Anyone who knows the secret URL token can permanently expire an anonymous push without any credentials. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81199.yaml MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81578.yaml PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82222.yaml GiveWP <= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85200.yaml GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86206.yaml A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86207.yaml An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal-only APIs. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86426.yaml LibreNMS <= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87820.yaml CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-88062.yaml OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9586.yaml Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/logs/apache-livy-logs.yaml Detects if the logs/metrics page of the Apache Livy server is exposed. Wed, 16 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/nacos/nacos-v3-auth-scope-bypass.yaml Nacos 3.0.0 through 3.2.3 contains an authentication scope misassignment vulnerability. The user, role, and permission management API endpoints (UserControllerV3, RoleControllerV3, PermissionControllerV3) have @Secured annotations missing the apiType attribute, defaulting to OPEN_API scope which is guarded by nacos.core.auth.enabled disabled by default. Wed, 16 Sep 2026 00:00:00 https://www.ddpoc.com/DVB-2026-11755.html Thu, 10 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 821 U9团队在获知XML注入漏洞后第一时间组织团队进行应急响应，分析接口带来的漏洞问题，并针对该漏洞规避可能引起的其他漏洞如代码执行、信息泄露和数据库提权等；现已修复以上漏洞。 Tue, 08 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 823 U9团队在获知接口SQL注入漏洞后第一时间组织团队进行应急响应，分析接口带来的漏洞问题，并针对该漏洞规避可能引起的其他漏洞如代码执行、信息泄露和数据库提权等；现已修复以上漏洞。 Tue, 08 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 822 U9团队在获知接口无授权访问漏洞后第一时间组织团队进行应急响应，分析接口带来的漏洞问题，并针对该漏洞规避可能引起的其他漏洞如代码执行、信息泄露和数据库提权等；现已修复以上漏洞。 Tue, 08 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 824 应用在处理文件下载请求时，未对用户传入的文件路径参数进行充分校验或过滤，导致攻击者可以通过构造参数下载服务器上本不应被访问的任意文件。 Tue, 08 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 818 U8+ EIS服务（企业空间插件）存在一组已过时的残留文件。当黑客通过其他途径获取到数据库密码后，可利用此残留文件的漏洞实现远程命令执行注入攻击。攻击者可通过此获取服务器信息甚至获得服务器控制权。<br> Mon, 07 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 820 <span style="color: rgb(0, 0, 0);">NC Cloud及YonBIP高级版存在datacollectservlet接口漏洞，影响系统的安全。</span> Mon, 07 Sep 2026 00:00:00 https://gobysec.net/updates# Jenkins Code Execution Vulnerability (CVE-2026-84645) Jenkins 是开源持续集成与持续交付（CI/CD）服务器，提供自动化构建、测试和部署能力，是企业级软件开发流水线的核心平台。Jenkins 存在反序列化漏洞，攻击者可借此在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。 Mon, 07 Sep 2026 00:00:00 https://gobysec.net/updates# JeecgBoot JimuReport /jmreport/auto/export/python/plugin Code Execution Vulnerability JeecgBoot 是北京国炬信息技术有限公司推出的企业级低代码开发平台，提供在线表单、工作流、报表、权限管理、代码生成等能力，适用于政企信息化系统、业务管理平台和快速应用开发场景。其积木报表（JimuReport）组件 /jmreport/auto/export/python/plugin 接口存在未授权代码执行漏洞。攻击者无需登录即可利用该接口执行任意代码及系统命令，进而完全控制服务器。 Mon, 07 Sep 2026 00:00:00 https://www.ddpoc.com/DVB-2026-11746.html 系统存在默认口令，攻击者可获取管理员权限。 Mon, 07 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 797 攻击者通过POSSyncService.asmx接口构造相关payload，进一步利用，可能会导致SQL注入。 Fri, 04 Sep 2026 00:00:00 https://www.twcert.org.tw/tw/cp-132-11176-a4cc2-1.html 【CVE-2026-85146(Use of Hard-coded Credentials)】未經身分鑑別之遠端攻擊者可於程式碼中取得SmartIT Agent程式之SSH服務帳號與通行碼。【CVE-2026-85147(Use of Hard-coded Credentials)】未經身分鑑別之遠端攻擊者可於程式碼中取得特定密碼，該通行碼可用於取得通訊用之AES加密金鑰。【CVE-2026-85148(Use of Hard-coded Credentials)】未經身分鑑別之遠端攻擊者可利用固定通行碼遠端存取使用者主機。【CVE-2026-85149(Use of Hard-coded Credentials)】未經身分鑑別之遠端攻擊者可於程式碼中取得SmartIT Agent程式之SFTP服務帳號與通行碼，進而瀏覽使用者主機檔案系統。 Fri, 04 Sep 2026 00:00:00 https://www.twcert.org.tw/tw/cp-132-11183-06a5e-1.html 【CVE-2026-85540(SQL Injection)】已通過身分鑑別之遠端攻擊者可注入任意SQL指令讀取、修改及刪除資料庫內容。【CVE-2026-85541(Reflected Cross-site Scripting)】已通過身分鑑別之遠端攻擊者可利用惡意網站於使用者端瀏覽器執行任意JavaScript程式碼。 Fri, 04 Sep 2026 00:00:00 https://stack.chaitin.com/vuldb/detail/7a5ace07-85aa-4720-967b-8db1e476c281 Proxmox VE 的 libpve-access-control 组件存在身份认证绕过漏洞。攻击者向 API 登录接口提交特制的 tfa-challenge 参数，可绕过密码验证，直接以未启用双因素认证（2FA）的现有用户身份登录，默认影响高权限的 root@pam 账户。 Thu, 03 Sep 2026 16:28:52 https://www.ddpoc.com/DVB-2026-11727.html 上海小羚羊软件股份有限公司小羚羊ERP系统其downloadView接口存在字符串拼接，并且没有鉴权，导致任意文件读取，攻击者可以利用该漏洞获取服务器敏感信息，从而进一步利用。 Thu, 03 Sep 2026 00:00:00 https://www.ddpoc.com/DVB-2026-11723.html 北京亿赛通科技发展有限责任公司电子文档安全管理系统CDGServer3-client存在前台sql漏洞，攻击者可通过该漏洞进行敏感数据获取。 Wed, 02 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 817 NC65系统存在任意文件下载漏洞，可窃取服务器敏感信息。 Wed, 02 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 816 用友GRP-U8Cloud产品下x/x/getUsersList及x/x/getNoteCode接口敏感信息泄露漏洞，攻击者通过匿名请求，然后构造参数，可获取项目的某些用户信息，存在安全风险。通过改造停用相关功能，校验token是否有效且在有效期，杜绝无token请求，解决以上的命令执行漏洞，降低相关的安全风险。 Wed, 02 Sep 2026 00:00:00 https://stack.chaitin.com/vuldb/detail/2d39959b-1e50-4193-8f58-6867b2e0a9f9 用友YonBIP旗舰版友户通CAS接口存在用户认证逻辑绕过漏洞。攻击者可利用该漏洞绕过认证机制，直接登录任意账户，导致系统权限失控，存在数据泄露、篡改及业务中断等严重风险。 Tue, 01 Sep 2026 15:47:54 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8225.yaml GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39258.yaml Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0743.yaml The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32475.yaml Elementor Pro plugin for WordPress in versions <=4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation() and process_field() methods iterate over submitted file entries with different early-exit logic for UPLOAD_ERR_NO_FILE entries. When an attacker submits two file parts for the same upload field — an empty first entry (blank filename triggering UPLOAD_ERR_NO_FILE) followed by a payload — validation() returns early after the empty entry without ever type-checking the payload, while process_field() only skips (continue) the empty entry and moves the payload to wp-content/uploads/elementor/forms/. The AJAX action elementor_pro_forms_send_form requires no authentication or nonce. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41042.yaml Apache Gravitino < 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42596.yaml Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses (such as http://[::ffff:127.0.0.1]) that bypass the deny-list and allow access to internal resources. Fixed versions properly recognize these addresses and prevent such requests. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44177.yaml Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55229.yaml Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode="External") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can open as images, or allow outbound requests to attacker-controlled endpoints. Version 8.34.0 disables resolution of external resources during document conversion to mitigate the vulnerability. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-73034.yaml DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9133.yaml Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/default-logins/johnson/johnson-controls-default-login.yaml Detected Johnson Controls Frick Quantum HD Compressor control panels are accessible with default PIN credentials. These are industrial refrigeration controllers used in cold storage and food processing facilities. Default PINs allow full control of the compressor system. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/apis/grafana-loki-api-exposure.yaml Grafana Loki API is accessible without authentication, allowing unauthorized access to log streams. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/apis/victoriametrics-vmagent-api-exposure.yaml VictoriaMetrics vmagent targets endpoint is exposed without authentication, leaking internal service inventory and scrape configuration. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/maven-settings-xml-exposure.yaml Detected An Apache Maven settings.xml file is exposed. The server section of this file stores the credentials Maven uses to authenticate to remote repositories and distribution servers, so a public copy can leak repository usernames and passwords. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/nuget-config-exposure.yaml Detected A NuGet.config file with a packageSourceCredentials section is exposed. NuGet stores per-feed authentication in this section and often keeps it as a ClearTextPassword, so a public copy leaks the username and password used to reach private package feeds. Tue, 01 Sep 2026 00:00:00 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/configs/pypirc-credentials-exposure.yaml Detected A Python .pypirc configuration file is exposed. This file stores the credentials used by tools like twine and setuptools to upload packages to PyPI or a private package index, and it commonly holds a plaintext password or an upload API token. Tue, 01 Sep 2026 00:00:00 https://www.ddpoc.com/DVB-2026-11720.html 信呼oa task.php 接口存在sql注入、XSS漏洞，攻击者可通过该漏洞进行敏感信息获取 Tue, 01 Sep 2026 00:00:00 https://www.ddpoc.com/DVB-2026-11721.html 湖南建研信息技术股份有限公司工程质量检测信息管理系统存在任意文件上传漏洞，攻击者可获取服务器权限。 Tue, 01 Sep 2026 00:00:00 https://security.yonyou.com/#/noticeInfo?id= 814 用友YonBIP旗舰版友户通cas接口存在用户认证逻辑绕过漏洞，攻击者利用此漏洞，可登录任意账户。总部紧急提供解决方案。请战略客户经营机构、区域客户经营机构、海外区、医疗行业客户与解决方案事业部、招聘云事业部实施负责人、客成负责人对应的实施和运维项目，以及各子公司（政务、金融、汽车、新道、烟草等）、商业伙伴部尽快通知所有客户部署，确保客户数据的安全。 Tue, 01 Sep 2026 00:00:00 https://gobysec.net/updates# Zhongcheng Kexin Ticket Management System /SystemManager/TicketSystem/ReturnTicketPlance.ashx SQL Injection Vulnerability 中成科信票务管理系统是北京中成科信科技发展有限公司面向旅游景区、演出剧院、体育场馆等场景打造的智慧票务管理平台，提供票类策略管控、售票流程管控、门票核验、营销渠道管理、财务结算等核心功能，支持二维码、RFID等多种防伪载体以及闸机、手持终端等多种检票方式，广泛应用于景区、场馆及活动票务运营。中成科信票务管理系统 /SystemManager/TicketSystem/ReturnTicketPlance.ashx 接口存在SQL注入漏洞，攻击者可获取数据库敏感信息。 Mon, 31 Aug 2026 00:00:00 https://gobysec.net/updates# Zhongcheng Kexin Ticket Management System /SystemManager/Planetarium/ReserveTicketManagerPlane.ashx SQL Injection Vulnerability 中成科信票务管理系统是北京中成科信科技发展有限公司面向旅游景区、演出剧院、体育场馆等场景打造的智慧票务管理平台，提供票类策略管控、售票流程管控、门票核验、营销渠道管理、财务结算等核心功能，支持二维码、RFID等多种防伪载体以及闸机、手持终端等多种检票方式，广泛应用于景区、场馆及活动票务运营。中成科信票务管理系统 /SystemManager/Planetarium/ReserveTicketManagerPlane.ashx 接口存在SQL注入漏洞，攻击者可获取数据库敏感信息。 Mon, 31 Aug 2026 00:00:00 https://gobysec.net/updates# FileRise /uploads File Read Vulnerability (CVE-2026-25231) FileRise 是一款开源的自托管文件管理器，提供文件上传下载、目录管理、WebDAV 访问、标签管理等功能，支持细粒度目录 ACL 权限控制，可部署于 Docker 等环境。FileRise 的 /uploads 目录存在文件读取漏洞，未认证攻击者在获知上传文件路径后可直接读取该目录中的文件，造成敏感数据泄露。 Mon, 31 Aug 2026 00:00:00 https://gobysec.net/updates# Yonyou Time-Space KSOA /worksheet/agent_worksadd.jsp SQL Injection Vulnerability 用友时空-KSOA系统的agent_worksadd.jsp页面存在SQL时间盲注漏洞，攻击者可通过构造恶意id参数注入SQL语句，利用WAITFOR DELAY实现时间延迟，获取数据库敏感信息，进一步可能导致系统被入侵控制。 Mon, 31 Aug 2026 00:00:00 https://gobysec.net/updates# JoomShaper SP LMS /index.php?option=com_splms&view=cart File Upload Vulnerability (CVE-2026-48909) JoomShaper SP LMS 是由 JoomShaper 团队为 Joomla 内容管理系统开发的学习管理系统（LMS）扩展，提供课程管理、在线学习、学员管理等功能，拥有超过 10 万次安装，被广泛应用于教育培训、在线课堂与知识付费等场景。SP LMS /index.php?option=com_splms\u0026view=cart 存在文件上传漏洞，攻击者可利用该漏洞向服务器任意目录写入恶意文件，进而执行任意代码，完全控制受影响系统。 Mon, 31 Aug 2026 00:00:00 https://gobysec.net/updates# Yonyou Time-Space KSOA /worksheet/agent_work_report.jsp SQL Injection Vulnerability 用友时空-KSOA系统的agent_work_report.jsp页面存在SQL时间盲注漏洞，攻击者可通过构造恶意id参数注入SQL语句，利用WAITFOR DELAY实现时间延迟，获取数据库敏感信息，进一步可能导致系统被入侵控制。 Mon, 31 Aug 2026 00:00:00