Nuclei POC 精选分析 - 2026-04-19
📊 智能筛选概况
- 发现变更: 300 个模板更新
- 精选分析: 8 个高价值 POC
- 智能跳过: 292 个低优先级模板
- 高风险漏洞: 5 个
- 主要类别: CVE漏洞(8)
💡 智能筛选说明: 系统自动优先分析 CVE 漏洞、高危漏洞和新增模板，跳过低价值的技术识别类模板，确保高效利用 API 资源。
严重程度分布
- 🔴 严重: 4 个
- 🟠 高危: 1 个
- 🟡 中危: 3 个
🔍 重点漏洞分析
GitLab - SAML Authentication Bypass
- 漏洞ID:
CVE-2025-25291 - CVE:
CVE-2025-25291(2025) - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: GitLab 平台
- 预估影响: 数千个
- EPSS: 0.13848 (percentile 0.94314) @ 2026-04-18
描述: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
攻击向量: 网络扫描
CVE编号: CVE-2025-25291
参考链接:
Sudo - Local Privilege Escalation via chroot
- 漏洞ID:
CVE-2025-32463 - CVE:
CVE-2025-32463(2025) - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: 未知
- 预估影响: 数千个
- EPSS: 0.38489 (percentile 0.9725) @ 2026-04-18
描述: Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
攻击向量: 网络扫描
CVE编号: CVE-2025-32463
参考链接:
RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token
- 漏洞ID:
CVE-2025-68926 - CVE:
CVE-2025-68926(2025) - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: 未知
- 预估影响: 数千个
- EPSS: 0.10607 (percentile 0.9331) @ 2026-04-18
描述: RustFS before 1.0.0-alpha.77 used a hardcoded gRPC authentication token "rustfs rpc" that could not be changed without recompiling and this allowed unauthenticated remote attackers to gain full administrative access to the gRPC API.
攻击向量: 网络扫描
CVE编号: CVE-2025-68926
参考链接:
WatchGuard IKEv2 Out-of-Bounds Write Vulnerability
- 漏洞ID:
CVE-2025-9242 - CVE:
CVE-2025-9242(2025) - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: 未知
- 预估影响: 数千个
- EPSS: 0.68973 (percentile 0.9864) @ 2026-04-18
描述: WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
攻击向量: 网络扫描
CVE编号: CVE-2025-9242
参考链接:
langchain-ai langchain - XML External Entity Injection
- 漏洞ID:
CVE-2025-6984 - CVE:
CVE-2025-6984(2025) - 严重程度: 🟠 HIGH
- 风险等级: 极高风险 (4.5/5)
- 影响资产: 未知
- 预估影响: 数千个
- EPSS: 0.01922 (percentile 0.83396) @ 2026-04-18
描述: langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
攻击向量: 网络扫描
CVE编号: CVE-2025-6984
参考链接:
📋 完整模板列表
| 模板名称 | 严重程度 | 类别 | 影响资产 | EPSS | 风险评分 |
|---|---|---|---|---|---|
| GitLab - SAML Authentication Bypass | 🔴 critical | CVE漏洞 | GitLab 平台 | 0.1385 | 5/5 |
| Sudo - Local Privilege Escalation via chroot | 🔴 critical | CVE漏洞 | 通用 | 0.3849 | 5/5 |
| RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authen | 🔴 critical | CVE漏洞 | 通用 | 0.1061 | 5/5 |
| WatchGuard IKEv2 Out-of-Bounds Write Vulnerability | 🔴 critical | CVE漏洞 | 通用 | 0.6897 | 5/5 |
| langchain-ai langchain - XML External Entity Injec | 🟠 high | CVE漏洞 | 通用 | 0.0192 | 4.5/5 |
| Backdrop CMS - Cross-Site Scripting | 🟡 medium | CVE漏洞 | 通用 | 0.2841 | 3.7/5 |
| Essential Addons for Elementor < 6.0.15 - Cross | 🟡 medium | CVE漏洞 | 通用 | 0.0256 | 3.5/5 |
| Swagger UI >=3.14.1 < 3.38.0 - DOM Base | 🟡 medium | CVE漏洞 | 通用 | 0.0051 | 3.5/5 |
🛡️ 安全建议
🚨 发现高风险漏洞，建议立即扫描相关资产 🔍 关注新发布的 CVE 漏洞，及时更新补丁 ⚡ 检测到远程代码执行漏洞，优先处理
🔧 扫描建议
建议使用以下 Nuclei 命令进行扫描：
# 扫描高危漏洞
nuclei -t code/cves/2025/CVE-2025-25291.yaml -t code/cves/2025/CVE-2025-32463.yaml -t code/cves/2025/CVE-2025-68926.yaml -t code/cves/2025/CVE-2025-9242.yaml -t code/cves/2025/CVE-2025-6984.yaml -u target-url
# 扫描所有今日新增模板
nuclei -t code/cves/2025/CVE-2025-25291.yaml -t code/cves/2025/CVE-2025-32463.yaml -t code/cves/2025/CVE-2025-68926.yaml -t code/cves/2025/CVE-2025-9242.yaml -t code/cves/2025/CVE-2025-6984.yaml -t headless/cves/2025/CVE-2025-25062.yaml -t headless/cves/2025/CVE-2025-24752.yaml -t headless/cves/2025/CVE-2025-8191.yaml -u target-url
本报告基于 Nuclei 模板库自动生成，数据来源：ProjectDiscovery/nuclei-templates
扫描建议仅供参考，请在授权环境下进行安全测试