CVE-2026-87115: Improper Limitation of a Pathname to a Restricted Directory

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD 인증서 서비스 발행일 : 10/05/2022 공격 복잡도: 낮음 필요한 권한: 낮음 CVSS 점수 : 8.1 이 취약점으로 인해 낮은 권한의 사용자가 Active Directory 인증서 서비스AD CS 서버 역할이 설치된 기본 Active Directory 환경에서 도메인 관리자로 권한을 상승시킬 수 있었습니다. Oliver Lyakly4k이 Python으로 익스플로잇을 개발했으며, 이는 공지 이전에 게시되었고 이후에는 게시되지 않았습니다. 개념 증명PoC으로 선언되었습니다. 익스플로잇은...

CVE-2026-82040

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040

UTMStack versions before 11.2.16 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the IdentityProviderService.validateMetadataUrl() function. Authenticated attackers can exploit the POST/PUT /api/identity-providers endpoint because the application fails to validate the...

EUVD-2026-91792

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

GHSA-XXV7-2VV3-H682 Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.21 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by zickzick2 in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.21...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104441

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

EUVD-2026-91469

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

malware-ioc

Lucid XinXinグループによって開発されたLucid Phishing-as-a-Service（PhAAS）プラットフォームは、郵便および宅配便サービスを含む世界中の組織を標的とする大規模なフィッシングキャンペーンを容易にします。RCSやiMessageといった高度な技術を活用し、このグループは検知を回避するために自動化ツールと回避技術を用いています。LARVA-242などの主要な攻撃者は、構造化された階層を通じて運用を管理し、窃取したデータを収益化しています。Lucidの技術的な精巧さと世界的なリーチは、PhAASプラットフォームの脅威の増大を浮き彫りにしています。...

smbtakeover

smbtakeover Windows上でドライバをロードせず、LSASSへモジュールをロードせず、ターゲットマシンを再起動せずに445/tcpのバインド解除と再バインドを行うためのテクニックです。C2経由でのSMBベースのNTLMリレーの負担を軽減するために実装されました。このテクニックの技術的分析は、x33fconでのRelay Your Heart Away: An OPSEC Concious Approach to 445 Takeoverプレゼンテーションで詳しく説明されています。...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

The vulnerability of the CheckAuthToken() function in the services/auth/auth_token.go file of the Git repository management system Gitea allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CheckAuthToken function in the services/auth/authtoken.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...

The vulnerability in the `services/lfs/server.go` and `routers/private/serv.go` files of the Git repository management system Gitea allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...

The vulnerability lies in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea. This vulnerability allows a attacker to compromise the integrity and accessibility of the protected information.

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

The vulnerability of the `updateRepository()` function in the `services/repository/repository.go` file of the Git repository management system Gitea allows a hacker to disclose protected information.

The vulnerability of the updateRepository function in the services/repository/repository.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

CVE-2026-85215: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09...