CVE-2021-38314

未经身份验证的敏感信息泄露 CVE-2021-38314 CVE-2021-38314的Python利用脚本 使用: python3 cve-2021-38314.py http://www.target.com Gutenberg Template Library & Redux Framework 插件 = 4.2.11 for WordPress 在 "redux-core/class-redux-core.php" 文件的 "includes" 函数中注册了多个 AJAX actions，这些 actions 可供未经身份验证的用户访问。这些 actions...

cve-2021-38314

cve-2021-38314 - 未经身份验证的敏感信息泄露 Gutenberg Template Library & Redux Framework 插件 = 4.2.11 版为 WordPress 在 redux-core/class-redux-core.php 的 includes 函数中注册了多个未验证用户可用的 AJAX 操作，这些操作对特定站点是唯一的，但可确定且可预测，因为它们基于站点 URL 的 md5 哈希（带有已知盐值 '-redux'）以及前一个哈希的 md5 哈希（带有已知盐值 '-support'）。这些 AJAX 操作可用于检索活动插件及其版本列表、站点的...

CVE-2021-38314

CVE-2021-38314 Python Exploit 详情 Gutenberg Template Library & Redux Framework 插件 PoC 示例 - https://youtu.be/n1e4aFmXvOk 链接 CVE-2021-38314...

WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

ImpactThe vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-4218: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTHKEY results in information disclosure. The attack is only possible...

Design/Logic Flaw

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

CVE-2021-38314

The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the "includes" function in "redux-core/class-redux-core.php" that were unique to a given site but deterministic and predictable given that they were...

PHPCMS V9 /phpcms/modules/vote/index.php 代码执行漏洞

漏洞影响版本：phpcms v9.5.8漏洞分析：hpsso/index.php文件所有的操作都存在严重的注入问题，这个类文件的构造函数最先调用它的父构造函数，通过authkey来解析POST传入的data内容，解析后data中的内容会作为注册、登陆、删除用户等操作的内容依据，而这些操作都会将这些数据作为数据库查询语句使用。这个问题其实在XXX的《PHPCMS V9...

TIPASK问答系统SQL注入三（有多个大型互联网企业案例）

简要描述： TIPASK问答系统SQL注入三（影响天极网、戴尔中国、WPS office、小米等网站） 详细说明： 部分案例： 通过源代码发现/control/gift.php存在注入，部分代码如下 function onadd ifisset$this-post'realname' $realname = $this-post'realname'; $email = $this-post'email'; $phone = $this-post'phone'; $addr = $this-post'addr'; $postcode = $this-post'postcode'; $qq ...

TIPASK问答系统SQL注入二（有多个大型互联网企业案例）

简要描述： 审核真给力，刚提交就通过了 ，赞啊！！！！ 详细说明： 部分案例： 经分析下列文件存在注入 /control/message.php 代码如下 function onremovedialog if$this-post'messageauthor' $authors = $this-post'messageauthor'; $ENV'message'-removebyauthor$authors; $this-message"对话删除成功!", geturlsource; 跟进removebyauthor函数 function removebyauthor$authors...