0day-Rubbish - Redefining vulnerability disclosure in the AI era.

项目说明

0day Rubbish

> 0day ha rubbish in the AI era.

![Latest batch]()
![Max CVSS]()
![PoC]()
![Website]()
![Watchers]()
![Discussions]()
![Last commit]()

🌐 Official Website: <

---

🎯 Why This Exists

Traditional disclosure is broken. It's slow, bureaucratic, and ineffective. In the AI era, we can mass-produce 0days at scale—making indi less but more impactful when disclosed directly.

We believe e security hardening is the most effecti: only when face real, exploitable threats do they prioritize fixes.

🔄 Our Disclosure Process

Step 1: AI Discovery

Our automated AI systems continuously scan for across real-world software, identifying potential 0-days through pattern analysis, fuzzing, and intelligent code review.

Step 2: & PoC De

Each finding undergoes manual . We develop working proof-of-concept exploits to confirm exploitability and assess real-world impact.

Step 3: Periodic Public Disclosure

Every week — Monday or Tuesday — we disclose a new batch of , exploitable 0-day we' and :

Full technical analysis and root cause

Working PoC exploit code

Affected and systems

Impact assessment

Recommended mitigations

No delays. No bureaucracy. Just facts.

To all : We hope you can complete fixes before hackers exploit these .

⚡ Core Principles

Real-world impact only: We disclose only that affect real-world systems with actual user bases

No worthless targets: Non-exploitable or devices with negligible user adoption are excluded—they're rubbish with zero value

Speed o: Direct disclosure dri action than traditional channels

Proof o: Every disclosure includes working exploits

Impact o: Focus on high-se, widely-deployed

Transparency: Full technical details, no hidden agendas

Non-profit: Driven by passion for security research, not financial gain

🤝 Collaboration

We partner with:

Top AI model pro ad automated security research

Security researchers exploring AI-powered discovery

🤖 AI Models Used

Our automated discovery le cutting-edge large language models from leading AI pro:

Anthropic (Claude) - Deep security pattern recognition and reasoning

OpenAI - Ad reasoning and code analysis

DeepSeek - Specialized detection

Z.ai (GLM) - Long-context code analysis

Moonshot (Kimi) - Long-context security analysis

---

📋 Disclosed

An AI-dri process (multi-LLM ensemble: Claude, OpenAI, DeepSeek, GLM, Kimi) discovers 0-days in real-world enterprise software. Every ad below ships a full root-cause analysis plus a working, reproducible exploit script — no detection-only writeups, no withheld details.

Latest Batch — Batch 13 (7 ad)

*Command execution reached from inside the product's own management surface — an unauthenticated report-upload page, a data-pipeline stage that compiles Scala, an energy gateway's event engine, a package-manager property, a media CGI, a banner uploader and a log .*

| # | Product | Affected | CVSS | Class | Ad & PoC |
|---|---------|------------------|------|-------|-----------------|
| 1 | Ad WebAccess Node (SCADA/HMI) | 9.2.3 | 9.8 \* | Unauthenticated CrystalRpt.aspx file upload with path tra → code execution in the IIS worker process | CrystalRpt.aspx → webshell → code execution |
| 2 | StreamSets Transformer | 3.17.0 | 8.1 \* | ScalaDTransform code field compiled and run by the full Scala compiler in the service JVM, no sandbox → container root | Scala stage → compiler → root |
| 3 | Circutor LineEds (industrial energy gateway) | 24.11.14-r0 | 9.8 \* | Unauthenticated events.xml write with a shellExecute action plus a restart trigger → system() in pwrstudio | events.xml shellExecute → system() |
| 4 | IPConfigure Orchid VMS | 26.3.0 | 7.2 \* | Authenticated gpg_key ser → DNF rpm --import {} → uid 0 | ser → rpm --import → root |
| 5 | Asustor ADM (AS602T) | 3.5.9.RWM1 | 8.8 \* | Authenticated music.cgi act=live → As_System = system() | music.cgi act=live → As_System |
| 6 | Maian Cart | 3.8 | 7.2 \* | Authenticated addBanners upload with no extension allow-list → webshell in a ser | banner upload → PHP webshell |
| 7 | RCDe (Freeware) | 2.4.14 | 7.2 | Authenticated logfile_.php sid → popen, executing as webadm (uid 999) on an IAM/MFA platform | sid → popen → webadm |

\* More than one reading is published. Each of these ad carries every reading alongside its own full , and labels what was what is conditional, inferred or rejected:

> - Finding 1 — primary 9.8 at PR:N, resting on the artifact-pro of any application-le in the page plus the structural argument that the product's own login page must be anonymous. The ad states plainly that no extracted installer artifact proves IIS anonymous authentication is enabled for that application path specifically, and publishes 8.8 at PR:L as the reading where it is not.
> - Finding 2 — primary 8.1 at AC:H, because the shipped configuration file sets http.authentication=aster; anonymous access requires the none mode, which is a documented operator-selectable value and a code-le rather than the shipped default. 9.8 at AC:L is published for deployments where that mode is in effect.
> - Finding 3 — primary 9.8 at PR:N grounded on a census of the authorization gate's 197 call sites, neither of which is on the path. The record's "security is disabled by default" assertion is published as un rather than as an artifact-pro setting, and 8.8 at PR:L is carried for the case where the gate applies.
> - Finding 4 — primary 7.2 at PR:H: the shipped OpenAPI specification grants the config scope required by this endpoint to the Administrator role only. 9.8 is the reading where the installer's default administrator password is unchanged, which the packaged debconf template does e. The research record's 8.8 at PR:L is disclosed and explained as not adopted.
> - Finding 5 — primary 8.8 at PR:L, the only session check standing between the caller and the handler, with no role or pri attribute consulted on that path. 7.2 at PR:H is published as a conditional, untested reading.
> - Finding 6 — primary 7.2 at PR:H, administrator session required. 9.8 at PR:N is labelled as this ad's own construction, conditional on deployment credentials that were ne to be guessable.
> - Finding 7 — 7.2 is the only score published. The research record carried 8.8 against the same PR:H , which does not compute to 8.8; that is disclosed, and PR:L/8.8 is left as an open question for the rather than adopted.

Totals: 7 ad · 7 · 3 in the unauthenticated class · 4 authenticated deep chains · every finding reaches operating-system command execution inside the product's own service or handler process. Executing identity is reported as measured where it was measured — uid 0 in a container (findings 2 and 4), webadm uid 999 (finding 7), uid 0 in a loopback lab process (finding 6) — and as a labelled inference where the de or shipped-pool identity was not measured (findings 1, 3, 5). No ad prints a score its own does not compute to.

How each finding was — stated here because the se, and because an ad that blurs this is worth less than one that doesn't:

4 driven over HTTP against a real running instance of the product — the official container image (finding 2), a real dpkg -i installation of the package inside a Linux container (finding 4), a genuine installation served by the PHP built-in server (finding 6), and the 's Docker image over TLS (finding 7). Each of these reached the service from the same host over a loopback-bound port; none was driven from a separate network host.

1 against shipped components deployed into a real IIS host o (finding 1): the code ran unmodified, but a stock installation was not achieved, so the public URL prefix is derived from a literal inside the decompiled page handler rather than from a request against a stock install.

2 with no li traffic at all — the shipped ARM binary under qemu-arm-static with the sink invoked through a debugger, and no HTTP request e (finding 3); and static analysis plus a faithful C replication of the sink run on an analysis host, with no physical device (finding 5).

Each ad says which applies in its own section 9 and repeats it in its summary, and none presents an emulated, replicated or component-level run as an exploit against a li device.

*Earlier batches: Batch #1 · Batch #2 · Batch #3 · Batch #4 · Batch #5 · Batch #6 · Batch #7 · Batch #8 · Batch #9 · Batch #10 · Batch #11 · Batch #12*

---

🔁 An Ongoing Series — Weekly Disclosures

This is a continuous disclosure series. Thanks to continuous optimization, the AI-dri pipeline now produces new 0-day findings at a stable daily rate, and we disclose batches on a weekly cadence.

Latest batch: Batch 13 — 7 ad; cumulative 121 across 13 batches

Next drop: every Monday or Tuesday

Future scope: expanding beyond enterprise IT into ICS / SCADA, energy, and aerospace systems

If you want to catch the next drop the moment it lands:

![Star]() ![Watch]() ![Blog]()

> ⭐ Star to bookmark · 👁 Watch (custom → Releases + Discussions) for new batches · 🌐 Follow the blog for per-ad updates.

---

📂 Submission Format

All disclosed follow a standardized directory structure:

Directory Rules

product/: Root directory for all

<>/: or product name (e.g., apache, cisco, sonicwall)

<>/: Affected range (e.g., 6.11.0, 12.4.2)

<>/: Classification (e.g., unauth-rce, auth-bypass, deserialization-rce)

Required Files in Each Directory

1. exploit/: Directory containing working exploit scripts and PoC code
2. analysis.md: Comprehensi analysis including root cause, attack , and impact
3. summary.md: Concise o with affected and quick mitigation steps

Example

---

Join us in redefining disclosure for the AI era.

项目信息

开发语言：Python

Star 数：223

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。