Nuclei POC 精选分析 - 2026-10-21

NucleiPOC分析漏洞扫描威胁情报

Nuclei POC 精选分析 - 2026-10-21

📊 智能筛选概况

  • 发现变更: 24 个模板更新
  • 精选分析: 24 个高价值 POC
  • 智能跳过: 0 个低优先级模板
  • 高风险漏洞: 20 个
  • 主要类别: CVE漏洞(22), 技术识别(2)

💡 智能筛选说明: 系统自动优先分析 CVE 漏洞、高危漏洞和新增模板，跳过低价值的技术识别类模板，确保高效利用 API 资源。

严重程度分布

  • 🔴 严重: 20 个
  • 🟡 中危: 2 个
  • ⚪ 信息: 2 个

🔍 重点漏洞分析

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

  • 漏洞ID: CVE-2026-56070
  • CVE: CVE-2026-56070 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32848) @ 2026-10-20

描述: Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.

攻击向量: 网络扫描

CVE编号: CVE-2026-56070

参考链接:

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

  • 漏洞ID: CVE-2026-52715
  • CVE: CVE-2026-52715 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32862) @ 2026-10-20

描述: The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-52715

参考链接:

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

  • 漏洞ID: CVE-2026-15015
  • CVE: CVE-2026-15015 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00712 (percentile 0.52779) @ 2026-10-20

描述: MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) <= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.

攻击向量: 网络扫描

CVE编号: CVE-2026-15015

参考链接:

Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

  • 漏洞ID: CVE-2026-72867
  • CVE: CVE-2026-72867 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: 未知
  • 预估影响: 数千个
  • EPSS: 0.00954 (percentile 0.60773) @ 2026-10-20

描述: Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.

攻击向量: 网络扫描

CVE编号: CVE-2026-72867

参考链接:

Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

  • 漏洞ID: CVE-2026-72867
  • CVE: CVE-2026-72867 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: 未知
  • 预估影响: 数千个
  • EPSS: 0.00954 (percentile 0.60773) @ 2026-10-20

描述: Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.

攻击向量: 网络扫描

CVE编号: CVE-2026-72867

参考链接:

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

  • 漏洞ID: CVE-2026-15015
  • CVE: CVE-2026-15015 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00712 (percentile 0.52779) @ 2026-10-20

描述: MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) <= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.

攻击向量: 网络扫描

CVE编号: CVE-2026-15015

参考链接:

The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection

  • 漏洞ID: CVE-2026-49772
  • CVE: CVE-2026-49772 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00454 (percentile 0.38144) @ 2026-10-20

描述: The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-49772

参考链接:

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

  • 漏洞ID: CVE-2026-52715
  • CVE: CVE-2026-52715 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32862) @ 2026-10-20

描述: The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-52715

参考链接:

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

  • 漏洞ID: CVE-2026-56070
  • CVE: CVE-2026-56070 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32848) @ 2026-10-20

描述: Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.

攻击向量: 网络扫描

CVE编号: CVE-2026-56070

参考链接:

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

  • 漏洞ID: CVE-2026-15015
  • CVE: CVE-2026-15015 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00712 (percentile 0.52779) @ 2026-10-20

描述: MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) <= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.

攻击向量: 网络扫描

CVE编号: CVE-2026-15015

参考链接:

The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection

  • 漏洞ID: CVE-2026-49772
  • CVE: CVE-2026-49772 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00454 (percentile 0.38144) @ 2026-10-20

描述: The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-49772

参考链接:

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

  • 漏洞ID: CVE-2026-56070
  • CVE: CVE-2026-56070 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32848) @ 2026-10-20

描述: Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.

攻击向量: 网络扫描

CVE编号: CVE-2026-56070

参考链接:

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

  • 漏洞ID: CVE-2026-52715
  • CVE: CVE-2026-52715 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32862) @ 2026-10-20

描述: The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-52715

参考链接:

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

  • 漏洞ID: CVE-2026-52715
  • CVE: CVE-2026-52715 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32862) @ 2026-10-20

描述: The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

攻击向量: 网络扫描

CVE编号: CVE-2026-52715

参考链接:

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

  • 漏洞ID: CVE-2026-56070
  • CVE: CVE-2026-56070 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.004 (percentile 0.32848) @ 2026-10-20

描述: Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.

攻击向量: 网络扫描

CVE编号: CVE-2026-56070

参考链接:

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

  • 漏洞ID: CVE-2026-15015
  • CVE: CVE-2026-15015 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00712 (percentile 0.52779) @ 2026-10-20

描述: MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) <= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.

攻击向量: 网络扫描

CVE编号: CVE-2026-15015

参考链接:

Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

  • 漏洞ID: CVE-2026-72867
  • CVE: CVE-2026-72867 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: 未知
  • 预估影响: 数千个
  • EPSS: 0.00954 (percentile 0.60773) @ 2026-10-20

描述: Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.

攻击向量: 网络扫描

CVE编号: CVE-2026-72867

参考链接:

Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

  • 漏洞ID: CVE-2026-72867
  • CVE: CVE-2026-72867 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: 未知
  • 预估影响: 数千个
  • EPSS: 0.00954 (percentile 0.60773) @ 2026-10-20

描述: Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.

攻击向量: 网络扫描

CVE编号: CVE-2026-72867

参考链接:

Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

  • 漏洞ID: CVE-2026-72867
  • CVE: CVE-2026-72867 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: 未知
  • 预估影响: 数千个
  • EPSS: 0.00954 (percentile 0.60773) @ 2026-10-20

描述: Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.

攻击向量: 网络扫描

CVE编号: CVE-2026-72867

参考链接:

TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass

  • 漏洞ID: CVE-2026-18315
  • CVE: CVE-2026-18315 (2026)
  • 严重程度: 🔴 CRITICAL
  • 风险等级: 极高风险 (5/5)
  • 影响资产: WordPress 站点
  • 预估影响: 数千万个
  • EPSS: 0.00598 (percentile 0.47669) @ 2026-10-20

描述: TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.

攻击向量: 网络扫描

CVE编号: CVE-2026-18315

参考链接:

📋 完整模板列表

模板名称严重程度类别影响资产EPSS风险评分
Advance Product Search <= 1.4.4 - Unauthen🔴 criticalCVE漏洞WordPress 站点0.00405/5
GEO my WP <= 4.5.5 - Unauthenticated SQL I🔴 criticalCVE漏洞WordPress 站点0.00405/5
MountDev AI MCP Connector <= 1.6.1 - Unaut🔴 criticalCVE漏洞WordPress 站点0.00715/5
Dokploy <= 0.29.12 - Authenticated RCE via🔴 criticalCVE漏洞通用0.00955/5
Dokploy <= 0.29.12 - Authenticated RCE via🔴 criticalCVE漏洞通用0.00955/5
MountDev AI MCP Connector <= 1.6.1 - Unaut🔴 criticalCVE漏洞WordPress 站点0.00715/5
The Events Calendar 6.15.12 - 6.16.2 - Unauthentic🔴 criticalCVE漏洞WordPress 站点0.00455/5
GEO my WP <= 4.5.5 - Unauthenticated SQL I🔴 criticalCVE漏洞WordPress 站点0.00405/5
Advance Product Search <= 1.4.4 - Unauthen🔴 criticalCVE漏洞WordPress 站点0.00405/5
MountDev AI MCP Connector <= 1.6.1 - Unaut🔴 criticalCVE漏洞WordPress 站点0.00715/5
The Events Calendar 6.15.12 - 6.16.2 - Unauthentic🔴 criticalCVE漏洞WordPress 站点0.00455/5
Advance Product Search <= 1.4.4 - Unauthen🔴 criticalCVE漏洞WordPress 站点0.00405/5
GEO my WP <= 4.5.5 - Unauthenticated SQL I🔴 criticalCVE漏洞WordPress 站点0.00405/5
GEO my WP <= 4.5.5 - Unauthenticated SQL I🔴 criticalCVE漏洞WordPress 站点0.00405/5
Advance Product Search <= 1.4.4 - Unauthen🔴 criticalCVE漏洞WordPress 站点0.00405/5
MountDev AI MCP Connector <= 1.6.1 - Unaut🔴 criticalCVE漏洞WordPress 站点0.00715/5
Dokploy <= 0.29.12 - Authenticated RCE via🔴 criticalCVE漏洞通用0.00955/5
Dokploy <= 0.29.12 - Authenticated RCE via🔴 criticalCVE漏洞通用0.00955/5
Dokploy <= 0.29.12 - Authenticated RCE via🔴 criticalCVE漏洞通用0.00955/5
TrueBooker <= 1.2.6 - Unauthenticated Auth🔴 criticalCVE漏洞WordPress 站点0.00605/5
WordPress WPLP Cookie Consent < 4.4.2 - SQL Inj🟡 mediumCVE漏洞WordPress 站点0.00313.5/5
WordPress WPLP Cookie Consent < 4.4.2 - SQL Inj🟡 mediumCVE漏洞WordPress 站点0.00313.5/5
Wowza Streaming Engine - Detect⚪ info技术识别通用-1/5
Wowza Streaming Engine - Detect⚪ info技术识别通用-1/5

🛡️ 安全建议

🚨 发现高风险漏洞，建议立即扫描相关资产 🔍 关注新发布的 CVE 漏洞，及时更新补丁 ⚡ 检测到远程代码执行漏洞，优先处理

🔧 扫描建议

建议使用以下 Nuclei 命令进行扫描：

# 扫描高危漏洞
nuclei -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-49772.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-49772.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-18315.yaml -u target-url

# 扫描所有今日新增模板  
nuclei -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-49772.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-49772.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-52715.yaml -t http/cves/2026/CVE-2026-56070.yaml -t http/cves/2026/CVE-2026-15015.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-72867.yaml -t http/cves/2026/CVE-2026-18315.yaml -t http/cves/2026/CVE-2026-82186.yaml -t http/cves/2026/CVE-2026-82186.yaml -t http/technologies/wowza-streaming-engine-detect.yaml -t http/technologies/wowza-streaming-engine-detect.yaml -u target-url

本报告基于 Nuclei 模板库自动生成，数据来源：ProjectDiscovery/nuclei-templates

扫描建议仅供参考，请在授权环境下进行安全测试

在 Twitter 上讨论•在 GitHub 上查看
上一篇文章
Nuclei POC 精选分析 - 2026-10-20
返回博客列表

文章目录

相关文章

Nuclei POC 精选分析 - 2026-10-20

4 个共同标签

从 600 个模板更新中精选分析 28 个高价值 POC，发现 22 个高风险漏洞

Nuclei POC 精选分析 - 2026-10-19

4 个共同标签

从 600 个模板更新中精选分析 22 个高价值 POC，发现 16 个高风险漏洞

Nuclei POC 精选分析 - 2026-10-17

4 个共同标签

从 604 个模板更新中精选分析 24 个高价值 POC，发现 16 个高风险漏洞

Nuclei POC 精选分析 - 2026-10-16

4 个共同标签

从 617 个模板更新中精选分析 30 个高价值 POC，发现 27 个高风险漏洞

Nuclei POC 精选分析 - 2026-10-15

4 个共同标签

从 618 个模板更新中精选分析 30 个高价值 POC，发现 27 个高风险漏洞

查看更多文章