next-CVE-2025-29927

CVE-2025-29927: Bypass de autorización en el middleware de Next.js Una vulnerabilidad crítica en Next.js CVE-2025-29927 permite el acceso no autorizado a rutas protegidas al omitir la lógica del middleware. El problema afecta a las versiones 11.1.4 a 13.5.6 de Next.js, y a las versiones 14.x...

route-detect

route-detect Encuentre errores de seguridad de autenticación authn y autorización authz en las rutas de aplicaciones web: Rutas del servidor de streamingkoel Los errores de autenticación y autorización en rutas HTTP de aplicaciones web son algunos de los problemas de seguridad más comunes hoy en...

CVE-2025-29927

Introduction Bypass Next.js middleware authentication mechanism by forging the x-middleware-subrequest request header, allowing unauthorized access to protected routes. Environment setup Source code derived from P神, Next.js version 15.2.2 For Next.js 15.x, this issue is fixed in 15.2.3...

CVE-2026-92972

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

EUVD-2026-81581

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

CVE-2026-92972

SGLang through 0.5.19 in prefill/decode disaggregation mode exposes an unauthenticated PUT /route endpoint on the prefill bootstrap service. An attacker can supply arbitrary rank_ip and rank_port values to poison the KV transfer routing table , redirecting decode workers to attacker-controlled en...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

CVE-2024-27198

CVE-2024-27198 CVE-2024-27198 - JetBrains TeamCity Server における代替パスを使用した認証バイパスの脆弱性 詳細については、Rapid7 のブログ投稿を参照してください: CVE-2024-27198 および CVE-2024-27199: JetBrains TeamCity の複数の認証バイパスの脆弱性 影響を受ける製品とバージョン: Product| Affected Versions ---|--- TeamCity Server| = 2023.11.3 CVSS: 9.8 活発に悪用されている: はい パッチ: はい...

wp2shell-PoC

wp2shell-PoC ⚠ 本工具仅用于教育或漏洞赏金目的。严禁在受控环境之外未经授权使用。 概述 针对影响 WordPress 核心的 wp2shell 漏洞链的概念验证（PoC），结合了 CVE-2026-63030 和 CVE-2026-60137。该项目演示了 REST API 批量路由混淆漏洞与 WPQuery SQL 注入之间的相互作用，形成一条无需认证即可完全入侵 WordPress 并实现远程代码执行（RCE）的路径。 阅读完整公告此处 工作原理 wp2shell 是 WordPress 核心中的一个认证前 RCE 链，结合了 CVE-2026-63030（批量 RES...

wp2shell-poc

wp2shell PoC WordPress REST API のバッチルート混乱チェーンに対する認証前タイミングベース SQL インジェクション PoC として、史上初の PoC です CVE-2026-63030 + CVE-2026-60137 単に管理者パスワードのクラックを試みるだけではなく、コマンド実行を達成しました。 影響を受けるバージョン: WordPress 6.9.0–6.9.4 および 7.0.0–7.0.1。6.9.5 と 7.0.2 で修正されました。 root@kitploit: python3 poc.py https://target.example...

CVE-2026-90982

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

EUVD-2026-81383

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-88904

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

EUVD-2026-81348

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-88904

The PuppyFW WordPress plugin through 0.4.4 has a broken authorization flaw in one of its REST routes: the plugin validates the caller against a capability value taken from the request itself rather than a server-side trusted source. This allows any authenticated user , including low-privilege sub...

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...