PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2015-0345] ColdFusion Bomb: A Chain Reaction From XSS to RCE

bishopfox.com | vulnerability | CVE-2015-0345 | #rce | #xss | #adobe | #exploit-chain | #coldfusion | #cve-2015-0345
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The technical companion to CVE-2015-0345: a DOM-based XSS in ColdFusion's admin panel chains into remote code execution by scheduling tasks and planting a CFML shell.
CVE
CVE-2015-0345
Published
Collected

Related coverage

vulnerability · bishopfox.com
Adobe ColdFusion Reflected Cross-Site Scripting Flaw
Advisory for CVE-2015-0345: a reflected XSS in ColdFusion's post-authentication admin panel chains into arbitrary command execution; affected versions 10 and 11; patched April 14, 2015.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System
Part three of the N-day exploit chain series, covering a Windows driver privilege-escalation flaw used to move from medium-integrity access to SYSTEM in a full exploit chain.
High · vulnerability · depthfirst.com
1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)
A 1-click RCE chain against OpenClaw, the open-source AI assistant: a gatewayUrl settings flaw plus a WebSocket pivot turn one malicious page visit into token theft and command execution.
vulnerability · swarm.ptsecurity.com
MyBB <= 1.8.31: Remote Code Execution Chain
A full exploit chain for MyBB <= 1.8.31: an SQL injection escalates to RCE when MyBB runs on PostgreSQL — pg_send_query allows stacked queries — with malicious templates executed by eval().
Back