Nuclei POC 精选分析 - 2026-10-24

📊 智能筛选概况

发现变更: 933 个模板更新
精选分析: 30 个高价值 POC
智能跳过: 903 个低优先级模板
高风险漏洞: 27 个
主要类别: CVE漏洞(30)

💡 智能筛选说明: 系统自动优先分析 CVE 漏洞、高危漏洞和新增模板，跳过低价值的技术识别类模板，确保高效利用 API 资源。

严重程度分布

🔴 严重: 16 个
🟠 高危: 11 个
🟡 中危: 3 个

🔍 重点漏洞分析

漏洞ID: CVE-2026-89079
CVE: CVE-2026-89079 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.00294 (percentile 0.20851) @ 2026-10-23

描述: Theme My Login (TML) <= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the$ update flag. During a lost password request (wp-login.php?action=lostpassword -> retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.

攻击向量: 网络扫描

CVE编号: CVE-2026-89079

参考链接:

Spring Cloud Gateway Server Webflux - Broken Access Control

漏洞ID: CVE-2025-41243
CVE: CVE-2025-41243 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.03548 (percentile 0.89252) @ 2026-10-23

描述: Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.

攻击向量: 网络扫描

CVE编号: CVE-2025-41243

参考链接:

DataEase - Remote Code Execution

漏洞ID: CVE-2025-49002
CVE: CVE-2025-49002 (2025)
严重程度: 🟠 HIGH
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.49985 (percentile 0.98902) @ 2026-10-23

描述: DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.

攻击向量: 网络扫描

CVE编号: CVE-2025-49002

参考链接:

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

漏洞ID: CVE-2026-109618
CVE: CVE-2026-109618 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.1162 (percentile 0.96047) @ 2026-10-23

描述: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

攻击向量: 网络扫描

CVE编号: CVE-2026-109618

参考链接:

Issabel Framework - Hard-Coded PBX API JWT Key

漏洞ID: CVE-2026-89026
CVE: CVE-2026-89026 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.00685 (percentile 0.52071) @ 2026-10-23

描述: Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.

攻击向量: 网络扫描

CVE编号: CVE-2026-89026

参考链接:

漏洞ID: CVE-2026-89079
CVE: CVE-2026-89079 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.00294 (percentile 0.20851) @ 2026-10-23

描述: Theme My Login (TML) <= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the$ update flag. During a lost password request (wp-login.php?action=lostpassword -> retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.

攻击向量: 网络扫描

CVE编号: CVE-2026-89079

参考链接:

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

漏洞ID: CVE-2026-90898
CVE: CVE-2026-90898 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.02311 (percentile 0.83266) @ 2026-10-23

描述: When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.

攻击向量: 网络扫描

CVE编号: CVE-2026-90898

参考链接:

参考资料

Spring Cloud Gateway Server Webflux - Broken Access Control

漏洞ID: CVE-2025-41243
CVE: CVE-2025-41243 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.03548 (percentile 0.89252) @ 2026-10-23

描述: Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.

攻击向量: 网络扫描

CVE编号: CVE-2025-41243

参考链接:

DataEase - Remote Code Execution

漏洞ID: CVE-2025-49002
CVE: CVE-2025-49002 (2025)
严重程度: 🟠 HIGH
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.49985 (percentile 0.98902) @ 2026-10-23

描述: DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.

攻击向量: 网络扫描

CVE编号: CVE-2025-49002

参考链接:

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

漏洞ID: CVE-2026-109618
CVE: CVE-2026-109618 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.1162 (percentile 0.96047) @ 2026-10-23

描述: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

攻击向量: 网络扫描

CVE编号: CVE-2026-109618

参考链接:

Issabel Framework - Hard-Coded PBX API JWT Key

漏洞ID: CVE-2026-89026
CVE: CVE-2026-89026 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.00685 (percentile 0.52071) @ 2026-10-23

描述: Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.

攻击向量: 网络扫描

CVE编号: CVE-2026-89026

参考链接:

漏洞ID: CVE-2026-89079
CVE: CVE-2026-89079 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.00294 (percentile 0.20851) @ 2026-10-23

描述: Theme My Login (TML) <= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the$ update flag. During a lost password request (wp-login.php?action=lostpassword -> retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.

攻击向量: 网络扫描

CVE编号: CVE-2026-89079

参考链接:

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

漏洞ID: CVE-2026-90898
CVE: CVE-2026-90898 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.02311 (percentile 0.83266) @ 2026-10-23

描述: When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.

攻击向量: 网络扫描

CVE编号: CVE-2026-90898

参考链接:

参考资料

Keras Model.load_model - Arbitrary Code Execution

漏洞ID: CVE-2025-1550
CVE: CVE-2025-1550 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.02626 (percentile 0.85381) @ 2026-10-23

描述: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading

攻击向量: 网络扫描

参考链接:

GitLab - SAML Authentication Bypass

漏洞ID: CVE-2025-25291
CVE: CVE-2025-25291 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: GitLab 平台
预估影响: 数千个
EPSS: 0.20965 (percentile 0.97562) @ 2026-10-23

描述: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.

攻击向量: 网络扫描

CVE编号: CVE-2025-25291

参考链接:

Sudo - Local Privilege Escalation via chroot

漏洞ID: CVE-2025-32463
CVE: CVE-2025-32463 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.55498 (percentile 0.99038) @ 2026-10-23

描述: Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.

攻击向量: 网络扫描

CVE编号: CVE-2025-32463

参考链接:

RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token

漏洞ID: CVE-2025-68926
CVE: CVE-2025-68926 (2025)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.3185 (percentile 0.98306) @ 2026-10-23

描述: RustFS before 1.0.0-alpha.77 used a hardcoded gRPC authentication token "rustfs rpc" that could not be changed without recompiling and this allowed unauthenticated remote attackers to gain full administrative access to the gRPC API.

攻击向量: 网络扫描

CVE编号: CVE-2025-68926

参考链接:

Phoenix Storybook - Remote Code Execution

漏洞ID: CVE-2026-8467
CVE: CVE-2026-8467 (2026)
严重程度: 🔴 CRITICAL
风险等级: 极高风险 (5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.02059 (percentile 0.8117) @ 2026-10-23

描述: Phenixdigital phoenix_storybook >=0.5.0 <1.1.0 contains a code injection caused by unsanitized attribute value interpolation in HEEx template generation, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires sending crafted WebSocket event data.

攻击向量: 网络扫描

CVE编号: CVE-2026-8467

参考链接:

Concrete CMS - User Enumeration

漏洞ID: CVE-2026-18110
CVE: CVE-2026-18110 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.00267 (percentile 0.17887) @ 2026-10-23

描述: Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel (concrete/controllers/panel/page/preview_as_user.php).

攻击向量: 网络扫描

CVE编号: CVE-2026-18110

参考链接:

参考资料

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

漏洞ID: CVE-2026-82901
CVE: CVE-2026-82901 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.01109 (percentile 0.65643) @ 2026-10-23

描述: Ultimate Addons for Contact Form 7 (UACF7) <= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons/pdf-generator/pdf-generator.php, which stores the file as "{time()}-{field_name}-{sanitize_file_name(basename)}". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME/extension allowlist.

攻击向量: 网络扫描

CVE编号: CVE-2026-82901

参考链接:

Concrete CMS - User Enumeration

漏洞ID: CVE-2026-18110
CVE: CVE-2026-18110 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.00267 (percentile 0.17887) @ 2026-10-23

描述: Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel (concrete/controllers/panel/page/preview_as_user.php).

攻击向量: 网络扫描

CVE编号: CVE-2026-18110

参考链接:

参考资料

Concrete CMS - User Enumeration

漏洞ID: CVE-2026-18110
CVE: CVE-2026-18110 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.00267 (percentile 0.17887) @ 2026-10-23

描述: Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel (concrete/controllers/panel/page/preview_as_user.php).

攻击向量: 网络扫描

CVE编号: CVE-2026-18110

参考链接:

参考资料

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

漏洞ID: CVE-2026-82901
CVE: CVE-2026-82901 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.01109 (percentile 0.65643) @ 2026-10-23

描述: Ultimate Addons for Contact Form 7 (UACF7) <= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons/pdf-generator/pdf-generator.php, which stores the file as "{time()}-{field_name}-{sanitize_file_name(basename)}". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME/extension allowlist.

攻击向量: 网络扫描

CVE编号: CVE-2026-82901

参考链接:

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

漏洞ID: CVE-2026-82901
CVE: CVE-2026-82901 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.01109 (percentile 0.65643) @ 2026-10-23

描述: Ultimate Addons for Contact Form 7 (UACF7) <= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons/pdf-generator/pdf-generator.php, which stores the file as "{time()}-{field_name}-{sanitize_file_name(basename)}". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME/extension allowlist.

攻击向量: 网络扫描

CVE编号: CVE-2026-82901

参考链接:

langchain-ai langchain - XML External Entity Injection

漏洞ID: CVE-2025-6984
CVE: CVE-2025-6984 (2025)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.01647 (percentile 0.76297) @ 2026-10-23

描述: langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.

攻击向量: 网络扫描

CVE编号: CVE-2025-6984

参考链接:

UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass

漏洞ID: CVE-2026-10795
CVE: CVE-2026-10795 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: WordPress 站点
预估影响: 数千万个
EPSS: 0.03635 (percentile 0.89507) @ 2026-10-23

描述: UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.

攻击向量: 网络扫描

CVE编号: CVE-2026-10795

参考链接:

Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG

漏洞ID: CVE-2026-31431
CVE: CVE-2026-31431 (2026)
严重程度: 🟠 HIGH
风险等级: 极高风险 (4.5/5)
影响资产: 未知
预估影响: 数千个
EPSS: 0.03437 (percentile 0.8891) @ 2026-10-23

描述: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

攻击向量: 网络扫描

CVE编号: CVE-2026-31431

参考链接:

📋 完整模板列表

模板名称	严重程度	类别	影响资产	EPSS	风险评分
Theme My Login <= 7.2.1 - Privilege Escala	🔴 critical	CVE漏洞	WordPress 站点	0.0029	5/5
Spring Cloud Gateway Server Webflux - Broken Acces	🔴 critical	CVE漏洞	通用	0.0355	5/5
DataEase - Remote Code Execution	🟠 high	CVE漏洞	通用	0.4999	5/5
PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Acti	🔴 critical	CVE漏洞	通用	0.1162	5/5
Issabel Framework - Hard-Coded PBX API JWT Key	🔴 critical	CVE漏洞	通用	0.0069	5/5
Theme My Login <= 7.2.1 - Privilege Escala	🔴 critical	CVE漏洞	WordPress 站点	0.0029	5/5
Bifrost < 2.1.0 - Unauthenticated MCP Stdio Com	🔴 critical	CVE漏洞	通用	0.0231	5/5
Spring Cloud Gateway Server Webflux - Broken Acces	🔴 critical	CVE漏洞	通用	0.0355	5/5
DataEase - Remote Code Execution	🟠 high	CVE漏洞	通用	0.4999	5/5
PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Acti	🔴 critical	CVE漏洞	通用	0.1162	5/5
Issabel Framework - Hard-Coded PBX API JWT Key	🔴 critical	CVE漏洞	通用	0.0069	5/5
Theme My Login <= 7.2.1 - Privilege Escala	🔴 critical	CVE漏洞	WordPress 站点	0.0029	5/5
Bifrost < 2.1.0 - Unauthenticated MCP Stdio Com	🔴 critical	CVE漏洞	通用	0.0231	5/5
Keras Model.load_model - Arbitrary Code Execution	🔴 critical	CVE漏洞	通用	0.0263	5/5
GitLab - SAML Authentication Bypass	🔴 critical	CVE漏洞	GitLab 平台	0.2097	5/5
Sudo - Local Privilege Escalation via chroot	🔴 critical	CVE漏洞	通用	0.5550	5/5
RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authen	🔴 critical	CVE漏洞	通用	0.3185	5/5
Phoenix Storybook - Remote Code Execution	🔴 critical	CVE漏洞	通用	0.0206	5/5
Concrete CMS - User Enumeration	🟠 high	CVE漏洞	通用	0.0027	4.5/5
Ultimate Addons for Contact Form 7 <= 3.5.	🟠 high	CVE漏洞	WordPress 站点	0.0111	4.5/5
Concrete CMS - User Enumeration	🟠 high	CVE漏洞	通用	0.0027	4.5/5
Concrete CMS - User Enumeration	🟠 high	CVE漏洞	通用	0.0027	4.5/5
Ultimate Addons for Contact Form 7 <= 3.5.	🟠 high	CVE漏洞	WordPress 站点	0.0111	4.5/5
Ultimate Addons for Contact Form 7 <= 3.5.	🟠 high	CVE漏洞	WordPress 站点	0.0111	4.5/5
langchain-ai langchain - XML External Entity Injec	🟠 high	CVE漏洞	通用	0.0165	4.5/5
UpdraftPlus WP Backup & Migration Plugin - Authent	🟠 high	CVE漏洞	WordPress 站点	0.0364	4.5/5
Copy Fail - Linux Kernel Local Privilege Escalatio	🟠 high	CVE漏洞	通用	0.0344	4.5/5
Essential Addons for Elementor < 6.0.15 - Cross	🟡 medium	CVE漏洞	通用	0.0123	3.5/5
Backdrop CMS - Cross-Site Scripting	🟡 medium	CVE漏洞	通用	0.0172	3.5/5
Swagger UI >=3.14.1 < 3.38.0 - DOM Base	🟡 medium	CVE漏洞	通用	0.0179	3.5/5

🛡️ 安全建议

🚨 发现高风险漏洞，建议立即扫描相关资产 🔍 关注新发布的 CVE 漏洞，及时更新补丁 ⚡ 检测到远程代码执行漏洞，优先处理

🔧 扫描建议

建议使用以下 Nuclei 命令进行扫描：

# 扫描高危漏洞
nuclei -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2025/CVE-2025-41243.yaml -t http/cves/2025/CVE-2025-49002.yaml -t http/cves/2026/CVE-2026-109618.yaml -t http/cves/2026/CVE-2026-89026.yaml -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2026/CVE-2026-90898.yaml -t http/cves/2025/CVE-2025-41243.yaml -t http/cves/2025/CVE-2025-49002.yaml -t http/cves/2026/CVE-2026-109618.yaml -t http/cves/2026/CVE-2026-89026.yaml -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2026/CVE-2026-90898.yaml -t code/cves/2025/CVE-2025-1550.yaml -t code/cves/2025/CVE-2025-25291.yaml -t code/cves/2025/CVE-2025-32463.yaml -t code/cves/2025/CVE-2025-68926.yaml -t code/cves/2026/CVE-2026-8467.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-82901.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-82901.yaml -t http/cves/2026/CVE-2026-82901.yaml -t code/cves/2025/CVE-2025-6984.yaml -t code/cves/2026/CVE-2026-10795.yaml -t code/cves/2026/CVE-2026-31431.yaml -u target-url

# 扫描所有今日新增模板  
nuclei -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2025/CVE-2025-41243.yaml -t http/cves/2025/CVE-2025-49002.yaml -t http/cves/2026/CVE-2026-109618.yaml -t http/cves/2026/CVE-2026-89026.yaml -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2026/CVE-2026-90898.yaml -t http/cves/2025/CVE-2025-41243.yaml -t http/cves/2025/CVE-2025-49002.yaml -t http/cves/2026/CVE-2026-109618.yaml -t http/cves/2026/CVE-2026-89026.yaml -t http/cves/2026/CVE-2026-89079.yaml -t http/cves/2026/CVE-2026-90898.yaml -t code/cves/2025/CVE-2025-1550.yaml -t code/cves/2025/CVE-2025-25291.yaml -t code/cves/2025/CVE-2025-32463.yaml -t code/cves/2025/CVE-2025-68926.yaml -t code/cves/2026/CVE-2026-8467.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-82901.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-18110.yaml -t http/cves/2026/CVE-2026-82901.yaml -t http/cves/2026/CVE-2026-82901.yaml -t code/cves/2025/CVE-2025-6984.yaml -t code/cves/2026/CVE-2026-10795.yaml -t code/cves/2026/CVE-2026-31431.yaml -t headless/cves/2025/CVE-2025-24752.yaml -t headless/cves/2025/CVE-2025-25062.yaml -t headless/cves/2025/CVE-2025-8191.yaml -u target-url

本报告基于 Nuclei 模板库自动生成，数据来源：ProjectDiscovery/nuclei-templates

扫描建议仅供参考，请在授权环境下进行安全测试

在 Twitter 上讨论•在 GitHub 上查看

上一篇文章

Nuclei POC 精选分析 - 2026-10-23

Nuclei POC 精选分析 - 2026-10-24

Nuclei POC 精选分析 - 2026-10-24

📊 智能筛选概况

严重程度分布

🔍 重点漏洞分析

Spring Cloud Gateway Server Webflux - Broken Access Control

DataEase - Remote Code Execution

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

Issabel Framework - Hard-Coded PBX API JWT Key

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

Spring Cloud Gateway Server Webflux - Broken Access Control

DataEase - Remote Code Execution

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

Issabel Framework - Hard-Coded PBX API JWT Key

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

Keras Model.load_model - Arbitrary Code Execution

GitLab - SAML Authentication Bypass

Sudo - Local Privilege Escalation via chroot

RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token

Phoenix Storybook - Remote Code Execution

Concrete CMS - User Enumeration

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Concrete CMS - User Enumeration

Concrete CMS - User Enumeration

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

langchain-ai langchain - XML External Entity Injection

UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass

Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG

📋 完整模板列表

🛡️ 安全建议

🔧 扫描建议

文章目录

相关文章

Nuclei POC 精选分析 - 2026-10-23

Nuclei POC 精选分析 - 2026-10-22

Nuclei POC 精选分析 - 2026-10-21

Nuclei POC 精选分析 - 2026-10-20

Nuclei POC 精选分析 - 2026-10-19

Nuclei POC 精选分析 - 2026-10-24

📊 智能筛选概况

严重程度分布

🔍 重点漏洞分析

Theme My Login <= 7.2.1 - Privilege Escalation

Spring Cloud Gateway Server Webflux - Broken Access Control

DataEase - Remote Code Execution

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

Issabel Framework - Hard-Coded PBX API JWT Key

Theme My Login <= 7.2.1 - Privilege Escalation

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

Spring Cloud Gateway Server Webflux - Broken Access Control

DataEase - Remote Code Execution

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

Issabel Framework - Hard-Coded PBX API JWT Key

Theme My Login <= 7.2.1 - Privilege Escalation

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

Keras Model.load_model - Arbitrary Code Execution

GitLab - SAML Authentication Bypass

Sudo - Local Privilege Escalation via chroot

RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token

Phoenix Storybook - Remote Code Execution

Concrete CMS - User Enumeration

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Concrete CMS - User Enumeration

Concrete CMS - User Enumeration

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload

langchain-ai langchain - XML External Entity Injection

UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass

Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG

📋 完整模板列表

🛡️ 安全建议

🔧 扫描建议

文章目录

相关文章

Nuclei POC 精选分析 - 2026-10-23

Nuclei POC 精选分析 - 2026-10-22

Nuclei POC 精选分析 - 2026-10-21

Nuclei POC 精选分析 - 2026-10-20

Nuclei POC 精选分析 - 2026-10-19