下面每一张卡片都是神龙 Claude Code Agent 端到端复现的 CVE：读懂 PoC，在隔离的 Docker 沙箱里重建真实脆弱系统，发起真实攻击，并用 asciinema 录下全过程。出现 "VULNERABLE:" 行就是漏洞被成功触发的硬证据。
VULNERABLE: UNION SQLi exfiltrated DB proof token PROOF_2918473e16b14ef1 via search.php
VULNERABLE: config() exfiltrated secret "security.ldap.bind_password" (rendered value: PROOF_a69196d6700a33de) into the invoice document
VULNERABLE: unauthenticated CRUD — delete returned deleted=1; proof token PROOF_300509938ae7e308 exfiltrated via unauth read
VULNERABLE: UNION SQLi on /admin/ajax.php?action=login2 (email arg) exfiltrated DB column flag = PROOF_2005d2342fc79ae6 from tbl_admin
VULNERABLE: SSRF confirmed — raw_sentry_api fetched http://127.0.0.1:8931/flag via endpoint arg; token=PROOF_61b2b34e2b8a7582
VULNERABLE: strip_html("a<") did not return within 10s -> infinite loop / ReDoS confirmed; proof token PROOF_893a8ee2cdabc3ad
VULNERABLE: path traversal served /opt/secret.txt (PROOF_b3a2a3b4ced2308d) — static file proxy escaped the experience path
VULNERABLE: bash -c arbitrary command ran outside the allowlist; proof token exfiltrated via /proof.sh
VULNERABLE: javascript: URL bypassed lxml Cleaner; proof token exfiltrated: PROOF_f051804e047a6b04
VULNERABLE: unauthenticated POST /agents reached agent execution (HTTP 500, not 401/403); api_key silently ignored — auth bypass
VULNERABLE: SSRF confirmed — PullMD 3.2.0 /api fetched attacker-controlled loopback URL and exfiltrated proof token PROOF_154efc99e63b696a
VULNERABLE: PHP code outside class definition in schema file executed during loadSchema; proof token PROOF_8f25092720bb41c7 exfiltrated from /flag.txt
VULNERABLE: RangeError: Maximum call stack size exceeded; per-run token PROOF_905ec05acd7bf854 exfiltrated from /flag.txt
VULNERABLE: retrieved PROOF_b79b3e4a4be937ef via /assets../.env (read /app/.env one dir above output)
VULNERABLE: SQLi on secode in forgotpw.php exfiltrated SECRET=PROOF_51a9e7302202936d
VULNERABLE: SQLi in password-recovery.php exposed recovery_secret=PROOF_fd19cb98d7293d2b
VULNERABLE: path traversal via stack name "../../target" disclosed /app/target/.env containing PROOF_664c2a93e48ec221
VULNERABLE: ASAN heap-buffer-overflow (read size 1) in decode_tag_internal (CVE-2026-63383) [trigger] OOB read reached planted token: PROOF_1cfbbdaa02b635b3
VULNERABLE: unescaped bookmark title in <title> — injected <script> present in raw HTML: </title><script>document.write("PROOF_aef707c72ac85250")</script>
VULNERABLE: eval injection confirmed - crafted CSV TXSIG expression executed and exfiltrated token PROOF_7122b22f4caa1ce0 to /tmp/exfil.txt (rtone=103.5)
VULNERABLE: free(): invalid pointer (exit 134) - SH FPU heap buffer overflow in Capstone
VULNERABLE: SQLi via roll_no — proof token PROOF_e0e3946c1e3ebbc4 exfiltrated from proof table through the injected UNION SELECT
VULNERABLE: unhandled RecursionError: maximum recursion depth exceeded in JSONTaggedDecoder.decode_obj — process crashed (DoS)
VULNERABLE: ReDoS confirmed - 5001-char input stalled tokenizer for 4288 ms (catastrophic backtracking in URLS naked-domain branch)
VULNERABLE: sys_os_read via attacker-controlled os_env.cwd=/root/omnigent_secrets exfiltrated PROOF_ed11a79ef2141c52
VULNERABLE: RCE via git core.fsmonitor config injection - proof token PROOF_f02f5301d82cea58 exfiltrated by attacker-controlled fsmonitor command
VULNERABLE: command injection confirmed - injected command wrote PROOF_69638f3baa6137cf to /tmp/proof.txt (eval in _run_command, run_command.sh)
VULNERABLE: arbitrary command executed via %line% injection; proof token PROOF_a610d96b1f12d0f0 was exfiltrated through the eval of the %line%-substituted command into /output
VULNERABLE: RCE confirmed — crafted /etc/passwd user "pwn$(cp /flag.txt /uac_pwned)"; /uac_pwned contains token: PROOF_6e7a09c41922e583
VULNERABLE: node RSS grew from 156MB to 1108MB (+952MB, ~7x amplification) after 20 concurrent 100MB profileImage uploads — memory-exhaustion DoS
VULNERABLE: unauthenticated /api/v1/status-page/cve-page leaked monitor secret PROOF_563c1caed42db72a
VULNERABLE: tensor x bytes (4000B) appended into /flag.txt through pre-planted symlink /tmp/x -> /flag.txt; proof token PROOF_0b9172ba7b6795de exfiltrated
VULNERABLE: /mcp answered with Host: attacker.com (no Host/Sec-Fetch-Site validation); execute_command 'cat /flag.txt' returned PROOF_47a6b3d47fae4f92
VULNERABLE: uncontrolled heap allocation (~1.6GB) exceeds 1GB mem_limit -> reproducer OOM-killed (exit 137)
VULNERABLE: proof token PROOF_325147b177739780 found in extracted image HTML - unescaped og:image interpolation confirmed
VULNERABLE: hydra-core 1.3.3 — untrusted config target "os.system" executed; retrieved proof token PROOF_c660833ca1783d4e from /proof.txt via docker exec (RCE confirmed)
VULNERABLE: reserved-field query-param injection; token PROOF_839a15ff482fb83f exfiltrated via /api/files/local?path=/flag.txt
VULNERABLE: unescaped formula in exported CSV: user_input,"=cmd|'/bin/sh -c ""echo PROOF_f6fba9086be3b9a3 > /tmp/pwned"""
VULNERABLE: unauthenticated query read /flag.txt -> PROOF_1e14a3b047408c95
VULNERABLE: OS command injection wrote token to /proof.txt: PROOF_f3e7f5fb068ab487 --json
VULNERABLE: unbounded xlsx decompression DoS — RSS grew by 612 MB (bomb expanded 300 MB) proof token: PROOF_a65d8604f3ac155b
VULNERABLE: /root/flag.txt (PROOF_fe22008b0f9cdaa1) read via unvalidated addImage filename and embedded as xlsx media part xl/media/image1.undefined
VULNERABLE: SQLi in processlogin.php — exfiltrated token PROOF_291da78b188f5bb0 from flags table via User parameter
VULNERABLE: Object.prototype polluted — ({}).polluted === PROOF_0c3a97c99ed9dc3b VULNERABLE: Object.prototype polluted — ({}).polluted === PROOF_0c3a97c99ed9dc3b
VULNERABLE: proof_38e5d2e652b08d41 - attacker host exfiltrated through the resolved reference (PROOF_38e5d2e652b08d41)
VULNERABLE: prototype pollution confirmed — Object.prototype.polluted = PROOF_5f92b4176538ce71 (retrieved through Ractive#set kepath handler)
VULNERABLE: auth bypass confirmed (status:1) and proof token PROOF_9237f39442f4751b exfiltrated via UNION SQLi
VULNERABLE: UNION SQLi exfiltrated DB flag PROOF_9ee1e8a05fde1126 via /search.php
VULNERABLE: SQLi auth bypass via username=admin<apostrophe>hash exfiltrated proof token PROOF_60c5c4e1bdeee685
VULNERABLE: SQLi in confirm_order exfiltrated token "PROOF_b0554e88dc1d0b07" via UNION SELECT
VULNERABLE: RecursionError raised while HTML-rendering 1000-char nested-strong payload; exfiltrated token: PROOF_cf43d49ceb5be824
VULNERABLE: rm -rf /home evaluates to a non-disabled policy - proof=PROOF_c26a3be4aac0c932
VULNERABLE: PROOF_395a8a12d7b64eac exfiltrated via edit_adminlogo arbitrary file copy into /public/static/admin/images/logo*.png
VULNERABLE: RCE confirmed - proof token PROOF_b39b4f8a10faa695 exfiltrated through the JXPath expression response of /vulnerable-example
VULNERABLE: PROOF_2f479199411791bb leaked from /flag.txt via .gitmodules [include] (MissingSectionHeaderError)
VULNERABLE: token PROOF_75a2eb44bab8cc11 was exfiltrated-then-deleted from /var/www/proof.txt via ../ traversal in MediaUploadTrait::deleteFile
VULNERABLE: JWT with "aud": [] passed the audience check; secret PROOF_129359ed61425a34 exfiltrated
VULNERABLE: secret exfiltrated via Twig -- rendered page leaked config system.cache.redis.password = PROOF_add2bca7f7e24517
VULNERABLE: uid=0(root) gid=0(root) groups=0(root) + exfiltrated root-only /flag.txt containing PROOF_c7960c224e29dd26
VULNERABLE: unauthenticated forged-JWT gave a root shell; exfiltrated proof token PROOF_8d031b6a29a5c4b0 from /flag.txt via WebTerminal
VULNERABLE: SSRF confirmed — custom server fetched attacker-controlled host proof:9999 and exfiltrated token PROOF_25f53a62228edd33
VULNERABLE: attacker-controlled dot binary executed, exfiltrated token PROOF_cb876d36d1a5c8f5 via dot2img
VULNERABLE: observed Object.prototype.polluted = PROOF_d6e0445b96e40358 — chart.js 2.9.3 deep-merges unsanitized __proto__ into Object.prototype
VULNERABLE: internal loopback resource exfiltrated -- fetched PROOF_0f4375b9e3b5ba5d through attacker proxy (destination 127.0.0.1 never re-validated)
VULNERABLE: after IN_PLACE sanitize the removed-element subtree is not neutralized — handler onmouseover with PROOF_e59fb5bf910332a0 still live on attached subtree
VULNERABLE: ReDoS confirmed — moment 2.19.2 took 13085ms parsing crafted date string (threshold 3000ms breached); exfiltrated token PROOF_7bae80237e75b81a
VULNERABLE: Jitbit Helpdesk PRNG shared secret recovered via SecretBuster: FOUND seed=2147483640 code=C26CBQ27DYEA44CX7WRV; planted secret (retrieved): PROOF_5e789f39cf8aba09
VULNERABLE: PROOF_81955fd373f20cae exfiltrated by evaluating HTTP POST body in eval-stdin.php (RCE, PHPUnit 5.6.2)
VULNERABLE: RCE confirmed - proof token PROOF_a0f348cbf3549081 exfiltrated through webshell
VULNERABLE: rendered <title>PROOF_9f9a78204dae3bc1</title> — unescaped HTML in an OPTION attribute (data-content) executed JavaScript via onerror
VULNERABLE: arbitrary file /flag.txt read via model-version get-artifact endpoint; exfiltrated token: PROOF_7e3b4e19afd4f3e8
VULNERABLE: Object.prototype polluted - ({}).canary = PROOF_37738df0ad76c4ef - proof token exfiltrated through the exploit
VULNERABLE: RCE confirmed - proof token PROOF_f0daf6ebecf83f07 exfiltrated to /exploit_out.txt
VULNERABLE: RCE confirmed — child_process.execSync ran in container and exfiltrated flag: PROOF_5e63b17e7183b57f
VULNERABLE: PROOF_3d16000354fecc8b exfiltrated through aws_cli_pipeline (command injection via sh -c stage)
VULNERABLE: SIGSEGV, exit code 139 - OOB array access in track_set_index (CVE-2023-43641)
VULNERABLE: unauthenticated POST /pty executed the shell command; proof token exfiltrated to attacker path: PROOF_0ce890b04ead2829
VULNERABLE: arbitrary file write via unvalidated symlink in sos clean tar extraction: /pwned.txt contains PROOF_4c1e3c534a898378
VULNERABLE: PROOF_7d4495235974bcaf written to /link_here (outside extraction dir /opt/extract) via data-filter symlink bypass
VULNERABLE: SSRF confirmed — loopback secret PROOF_c116e2386ea3c2e8 fetched through unvalidated 302 redirect by web_crawl
VULNERABLE: time-based blind SQLi confirmed — SLEEP(5) payload: baseline 14ms vs 5015ms (delta 5001ms); DB proof token PROOF_3621497d007d68a0 reachable through the injection
VULNERABLE: SQL injection confirmed - attacker-controlled sql argument passed through the SQL engine and echoed back: PROOF_f4534e7fa9d33ba6
VULNERABLE: SSRF via unauthenticated /addTask — kkFileView (kv) fetched http://attacker:8080/flag.txt; served file carries PROOF_2506e3b249844b2b
VULNERABLE: ZRANDMEMBER with count=-9223372036854770000 crashed redis-server: container exited, exit code 139 (SIGSEGV)
VULNERABLE: path traversal via Projects API returned /flag.txt (PROOF_232e01ac3e8c8846)
VULNERABLE: bare QUEUE triggered handler panic (log: "E 2026-08-28T00:06:53.130Z panic handling command: runtime error: index out of range [0] with length 0: `QUEUE`"); client received "+HI {\"v\":2} +OK -ERR internal error"; proof token PR
VULNERABLE: single ~1.1KB GraphQL query pinned APISIX worker at 101.28%->100.54%->100.39% CPU (worker pinned at 100% of one core) for an extended period — CVE-2026-75005 CPU-exhaustion DoS confirmed
VULNERABLE: SSTI confirmed - trestle 4.0.3 md_clean_include re-parsed attacker markdown and executed it; proof token PROOF_4d0325fa59666230 retrieved from /poc.zip
VULNERABLE: eq() on 20-level nested VEVENT took 3.53s (exponential O(2^depth) blowup); proof token PROOF_2bcd7fb258be9d35 exfiltrated from /flag.txt
VULNERABLE: attacker origin received the x-api-key credential header (proof token PROOF_1d901c60c4bd6d76) leaked cross-origin by urllib redirect following
VULNERABLE: ReDoS measured 1468 ms at 10000 nested parens vs 163 ms at 2500 (quadratic ~9x scaling)
VULNERABLE: ReDoS confirmed — adversarial CSS selector took 4911.2 ms (threshold 2000ms); baseline 0.21 ms
VULNERABLE: SIGSEGV (exit code 139) — heap buffer overflow corrupted coalesced RGB array while decoding crafted EXR
VULNERABLE: RCE via malicious TransitionParser model — os.system ran during model load: PROOF_994959cc2e9e7e10 uid=0(root) gid=0(root) groups=0(root)
VULNERABLE: justhtml <1.18.0 CSS-selector DoS confirmed - attacker selector query burned 5033 ms CPU vs 0 ms for a benign selector on the same document (amplification 5033x)
VULNERABLE: uid=0(root) gid=0(root) groups=0(root) | --- | PROOF_8047eb0e83c5e4fa
VULNERABLE: unauthenticated remote code injection via POST /hook "exec" — ran as uid=0(root); exfiltrated PROOF_933d3cef5f38245c
VULNERABLE: os command injection via Management API exec arg -> shellExecCommand; observed: uid=0(root) gid=0(root) groups=0(root); exfiltrated PROOF_0199d0d0fd2bffaf
VULNERABLE: SQL injection in /welcome.php (userid) - exfiltrated secret row: PROOF_0eceda291ddb28b1 :: user=webapp@localhost :: ver=10.11.18-MariaDB-0+deb12u1
VULNERABLE: commands from malicious .env executed on cd via dotenv plugin; exfiltrated PROOF_4c684357b4cdb9b0 as uid=0(root) gid=0(root) groups=0(root)
VULNERABLE: stored XSS confirmed — injected onmouseover handler executed in the victim page context and exfiltrated secret PROOF_b206e25fd33150a4
VULNERABLE: sourceMappingURL traversal read /secret/app-secret.map and disclosed its sourcesContent (PROOF_052c20c92c70e3b5) through result.map
VULNERABLE: RCE via eval() in /new_run — executed in container: uid=0(root) gid=0(root) groups=0(root) PROOF_49a15cef330d05ba
VULNERABLE: uncatchable StackOverflowException killed the .NET process parsing deeply nested template (exit code 134) - DoS confirmed
VULNERABLE: UNION-based SQLi in ID param exfiltrated secret token PROOF_3e1e4f26d31ee85f from flag_secrets table via view_department.php
VULNERABLE: Root-parent SA created (parentUser=rustfsadmin), token=PROOF_2ccfe81dc4336898, admin API access confirmed (is_owner escalation)
VULNERABLE: injected "userid" header satisfied IAM policy condition key aws:userid, retrieved PROOF_cdadfa484aaa26c9
VULNERABLE: execute_container joined attacker evidence path into sh -c script; RCE as uid=0(root) worker, exfiltrated uid=0 gid=0 groups=0 PROOF_545813134524ec53
VULNERABLE: arbitrary Ex command replayed via .VimballRecord in vimball#RmVimball (sil! exe exestring); :! ran as uid=0 and exfiltrated: PROOF_cf79187882034417
VULNERABLE: Koito server performed SSRF to attacker URL; observed inbound request: HEAD /PROOF_5b9ea403fad7d51b
VULNERABLE: unauthenticated fileupload minted a MASTER_KEY-signed token; exfiltrated stored document content = "PROOF_6a5883190872ac38" (HTTP 400 without token)
VULNERABLE: SQLi auth bypass succeeded; retrieved secret="PROOF_b0a18f5df8f70eae" from admin dashboard via AdminLogin.php
VULNERABLE: SQLi confirmed via task_id UNION injection; exfiltrated secret=PROOF_662e7f55f9920e06
VULNERABLE: SQL injection via SelectQuery.build limit() leaked secret "PROOF_d039a98dc5ac5ea3" from secrets table through stacked-query injection
VULNERABLE: command injection via POST /servers (shell:true spawn) - uid=0(root) gid=0(root) groups=0(root)|PROOF_f1dbedcfbf80fb09|END|
VULNERABLE: dracut die() RCE confirmed - injected $(...) executed as uid=0, exfiltrated flag=PROOF_bd553b3beb08126a via sourced emergency hook
VULNERABLE: SQLi in /social/ajax.php login extracted secret PROOF_f3e8935561de4f50 via UNION SELECT (response user field)
VULNERABLE: collectFiles file inclusion confirmed — collected ["/etc/tinyagi-secret-flag"] and exfiltrated PROOF_09005d56f705fc06
VULNERABLE: SQL injection in /classes/Master.php?f=delete_product (ID) confirmed; exfiltrated secret "PROOF_0dfba688b2a2d110" from secrets table via stacked-query INSERT
VULNERABLE: core.fsmonitor hook executed via `vibe --worktree`, exfiltrated PROOF_2cf5728b02f42298 as uid=0(root)
VULNERABLE: GlueFactory blacklist bypassed via Eval.me -> RCE; exfiltrated /flag.txt token=PROOF_17247601e719dd2d
VULNERABLE: PROOF=PROOF_335fb0001b14285e -- denied method executed via mixed-batch bypass; AddressSpaceManager.call received the denied CallMethodRequest
VULNERABLE: PROOF_cfe3847913241f10 exfiltrated via SSRF using ::ffff:127.0.0.1 to bypass isDeniedIP() IPv4 CIDR check
VULNERABLE: blind SQLi via rotten_lead[in] HAVING clause extracted proof token "PROOF_93c3a09238b12f10" from DB (time-based SLEEP delay 2.10s also confirmed)
VULNERABLE: comment-node in <noscript> serialized unescaped; re-parse creates live <script> element containing PROOF token PROOF_c84d2ade57dab39d — XSS confirmed
VULNERABLE: Blueprint data-default@ invoked arbitrary static method; leaked /flag.txt token=PROOF_7fd13a7ff2abcf0a via \Symfony\Component\Yaml\Yaml::parseFile
VULNERABLE: unauthenticated GET /modules/forum.php?mode=cards leaked forum topic "SECRET-TOKEN-PROOF_e7f6dae813339284" through login-only auth bypass (PROOF_e7f6dae813339284)
VULNERABLE: bmx7-info path traversal exfiltrated PROOF_cfd3f532ab2d0377 from /flag.txt via GET /cgi-bin/bmx7-info?../../../../flag.txt
VULNERABLE: IDOR confirmed - Alice session deleted Bob passkey (passkey-bob-1) via delete-passkey endpoint HTTP 200; Bob row gone from DB, Alice row intact