luelueking

5 exploits Active since Jun 2022
CVE-2022-25845 NOMISEC HIGH WORKING POC
fastjson < 1.2.83 - Deserialization of Untrusted Data via autoType Bypass
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
106 stars
CVSS 8.1
CVE-2022-4566 WRITEUP MEDIUM WORKING POC
y_project RuoYi <4.7.5 - SQL Injection
A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/generator/controller/GenController. The manipulation leads to sql injection. The name of the patch is 167970e5c4da7bb46217f576dc50622b83f32b40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215975.
CVSS 5.5
CVE-2023-27821 WRITEUP CRITICAL WRITEUP
Databasir 1.0.7 - Remote Code Execution via Mock Data Script Parameter
Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
CVSS 9.8
CVE-2023-30331 WRITEUP CRITICAL WORKING POC
beetl 3.15.0 - Server-Side Template Injection via Render Function
An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
CVSS 9.8
CVE-2023-51653 WRITEUP CRITICAL WRITEUP
Hertzbeat <1.4.1 - Command Injection
Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.
CVSS 9.8