CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

auth-header-trust-rules

auth-header-trust-rules حزمة قواعد Semgrep صغيرة تشير إلى التعليمات البرمجية التي تتخذ قرارات المصادقة أو التفويض أو الثقة استنادًا إلى ترويسات طلبات HTTP يمكن للمهاجم التحكم بها. المثال النموذجي لهذه الفئة من الثغرات هو CVE-2025-29927: وثِق Next.js بترويسة x-middleware-subrequest لتقرير ما إذا ك...

CVE-2026-12260

The NetBoard CRM demo platform is vulnerable to a SQL injection flaw in the ‘user-name’ POST parameter of the ‘/module/auth/recovery.php’ endpoint. The vulnerability allows for blind attacks using Boolean, error, time-based, and UNION techniques. Successful exploitation enables an attacker to ext...

CVE-2026-12260 SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB Pre-Auth RCE CVSS 10.0 ⚠️ تحذير يحتوي هذا المستودع على PoC وظيفية لـ CVE-2026-45829. للاستخدام فقط في الاختبارات المصرح بها في بيئات خاضعة للرقابة. الوصف ثغرة أمنية حرجة في ChromaDB الإصدارات 1.0.0 حتى 1.5.8 تسمح لمهاجم غير مصادق بتنفيذ تعليمات برمجية عشوائية عن طريق تحمي...

CVE-2022-3294

مرجع الاستغلال: https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf التعداد: 1. احصل...

AndroidAuto

Open Android Auto An open-source implementation of the Android Auto phone-side app. This app runs on your phone and projects to a car's head unit over USB, replacing Google's proprietary com.google.android.projection.gearhead APK. ⚠️ WORK IN PROGRESS This project is in early development. The...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - تجاوز المصادقة لاستخراج مستخدمي الإدارة وإعدادات LDAP - يقوم هذا الـ PoC بإجراءات للقراءة فقط. تشغيل الاستغلال USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com تشغيل قالب nuclei echo https://target.com | nuclei -t...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

WooCommerce Payments - Unauthorized Admin Access

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

F5 BIG-IP Appliance Mode - Command Injection

When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. id: CVE-2022-41800 info: name: F5 BIG-IP Appliance Mode - Command Injection author: dwisiswant0 severity: high description...

Zabbix - SAML SSO Authentication Bypass

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...

cve-2026-43512-poc

CVE-2026-43512 — تجاوز مصادقة DIGEST في Apache Tomcat نتيجة تحليل قابلية الاستغلال: تم تأكيد السبب الجذري. الاستغلال الكامل غير قابل للتكرار ضد نشر قياسي لـ UserDatabaseRealm. انظر التحليل للتفاصيل. جدول المحتويات نظرة عامة الإصدارات المتأثرة السبب الجذري التحليل هيكل المستودع المتطلبات الاستخدام...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

PT-2026-107869

Name of the Vulnerable Software and Affected Versions NetBoard CRM demo platform affected versions not specified Description An issue exists in the '/module/auth/recovery.php' endpoint where the user-name POST parameter is susceptible to SQL injection. This allows for blind attacks using Boolean,...

UBUNTU-CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452

watchTowr-vs-Citrix-Netscaler-PreAuth-RCE Générateur d'artefacts de détection pour Citrix NetScaler CVE-2026-8452 Voir notre article de blog pour les détails techniques. Détection en action python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://172.16.5.12:9443/ / | | |\ \ \ / / ...

confusploit

Ce script permet de trouver les serveurs vulnérables à CVE-2022-26134 et peut être utilisé avec SHODAN CLI et un one-liner Bash Veuillez l'utiliser uniquement à des fins légales et éducatives Exécution de code à distance pré-authentifiée via injection OGNL CVE-2022-26134 Le 2 juin 2022, Atlassian...

CVE-2026-107281

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...