[原创]从POC到EXP：从0基础到v8 CVE-2021-38003复现
CVE-2021-38003
[原创]从POC到EXP：从0基础到v8 CVE-2021-38003复现
2026-05-17 归档
今日共收录 761 条安全情报，包含 52 个 CVE，439 篇安全通告，以及 15 篇研究论文。
← 返回归档列表The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capab...
CVE-2026-8719
WordPress插件AI Engine（版本3.4.9）存在权限提升漏洞。该漏洞源于MCP OAuth持有者令牌授权路径中缺少WordPress能力检查，任何有效的OAuth令牌都会授予MCP访问权限，而无需验证管理员权限。这导致通过身份
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is ...
CVE-2026-8723
CVE-2026-8723 是 Node.js 查询字符串解析库 qs 中的一个拒绝服务漏洞，影响版本 6.11.1 至 6.15.1（含）。当调用 `qs.stringify` 方法时，如果同时设置 `arrayFormat: 'comm
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-6050
该 CVE 记录已被其编号机构 (CNA) 拒绝或撤销。NVD 元数据显示状态为 'Rejected'，无 CVSS 评分、EPSS 概率、受影响产品或厂商信息。这意味着该编号对应的漏洞从未被接受或已被废弃，不存在真实安全风险。建议忽略此
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
CVE-2026-46728
Das U-Boot 2026.04之前版本中的FIT（扁平映像树）签名验证存在绕过漏洞，原因是哈希计算时未包含'hashed-nodes'字段。攻击者可利用此漏洞，通过构造特制的FIT映像，绕过签名验证机制，从而在目标系统上加载并执行未授
Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads throug...
CVE-2021-47981
CVE-2021-47981 是 Quick.CMS 6.7 版本中 sliders 表单存在的一个跨站脚本（XSS）漏洞。攻击者可以通过向 sDescription 参数提交恶意 payload，在管理员提交表单时执行任意 JavaScr
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the ...
CVE-2021-47957
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject
EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstnam...
CVE-2021-47956
EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate da
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the fil...
CVE-2021-47955
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary Ja
LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query paramet...
CVE-2021-47954
LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queri
Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via ...
CVE-2021-47942
Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attacke
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fie...
CVE-2021-47934
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts
Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service b...
CVE-2020-37247
Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local att
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path p...
CVE-2020-37246
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and d
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting di...
CVE-2020-37245
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attac
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the...
CVE-2020-37244
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through ...
CVE-2020-37243
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenti
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through...
CVE-2020-37242
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting maliciou...
CVE-2020-37241
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative a
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fie...
CVE-2020-37240
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrat