CVE-2015-1635_PoC

使用方法: python3 CVE-2015-1635PoC.py 例: python3 CVE-2015-1635PoC.py http://www.xxx.com...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-71178

The Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this flaw to gain Unauthorized access . No s...

EUVD-2026-85330

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-20384

SPLUNK CVE-2025-20384 なぜか知らないけど、友達が送ってきたものを読んで、適当なJavaScriptコードを打ち始めた。 Log Injection/Forgery/Poisoning/Obfuscate type POC この記事をお読みください OWASP Log Injection TL;DR 静的ファイルを探し、それを渡してランダムなパラメータを追加する そこで、以下のように実行する。curl -k...

CVE-2026-79079

A flaw was found in CrossWire Xiphos. A local attacker could exploit this vulnerability by manipulating specific components related to URL handling and menu popups. This could lead to arbitrary code execution on the affected system...

CVE-2026-96443

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-96443

A vulnerability exists in Apache Doris due to insufficient validation of the JDBC driver URL . This flaw allows a privileged user to achieve remote code execution (RCE) on the FE (Front-End) . While the CVSS score indicates a medium severity, the technical impact is described as partial. No speci...

EUVD-2026-85178

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

RTF-Cleaner

RTF-Cleaner CVE-2017-0199 ドキュメントを対象とした、URL を静的に検出する RTF 難読化解除ツール。 このツールを使用すると、難読化された RTF ドキュメント内の URL を静的に検出できます。 使い方: .\rtfCleanerUniversal.ps1 path-to-file 例: .\rtfCleanerUniversal.ps1 'C:\Users\yams\Downloads\invoiceForYams.doc' 組み込みの正規表現で何も見つからない場合は、rtf ファイル内で見つけたもの、すなわち pntxtb、lchars...

CVE-2025-10035_GoAnywhere

GoAnywhere CVE-2025-10035 チェッカー 説明 GoAnywhere インスタンスが CVE‑2025‑10035 に対して脆弱かどうかを検出する、軽量な Python チェッカー です。 このツールは、ランダム化された User-Agent（fake-useragent とフォールバックリストを使用）を伴う巧妙に細工された GET リクエストを送信し、リダイレクトには追従せず 、Location ヘッダーを検査して、インスタンスを未パッチ（脆弱）または パッチ適用済み（脆弱ではない）に分類します。 注: このリポジトリには現在チェッカーのみ が含まれています。Po...

CVE-2026-63278

A flaw was found in LibreOffice. A remote attacker could craft a malicious document containing specially constructed URLs. When a user opens this document, these URLs could expand environment variables or INI file values, leading to the exfiltration of potentially sensitive information to a remot...

swagger-ui

소개: Swagger UI의 역할 Swagger UI 는 OpenAPI이전 명칭 Swagger 명세를 대화형 웹 인터페이스로 렌더링하는 널리 사용되는 라이브러리입니다. 이를 통해 개발자와 통합자는 백엔드 구현 없이도 API를 탐색하고 테스트할 수 있습니다. CVE‑2018‑25031 상세 정보 근본 원인: 원격 명세 로딩 이 취약점은 Swagger UI 클라이언트가 원격 설정 또는 명세 파일을 로드하는 데 사용하는 URL 쿼리 매개변수의 유효성 검사가 불충분하여 발생합니다. 관련된 일반적인 매개변수는 다음과 같습니다...

CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-84168

The Easy Hide Login WordPress plugin, in versions prior to 1.7 , fails to fully enforce its hidden-login protection. This flaw allows an unauthenticated attacker to bypass the security measures by using specific password-reset request parameters to access the standard login page. Furthermore, the...

EUVD-2026-85034

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84046 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...