CVE-2023-43326

mooSocial: XSS CVE-2023-43326 mooSocial v3.1.8의 여러 URL에 반사형 XSS 취약점이 존재합니다. 이 취약점을 통해 공격자는 조작된 URL을 사용하여 사용자의 세션 쿠키를 탈취하고 계정을 가장할 수 있습니다. 참고: 이러한 URL이 Referer 헤더에 사용될 때도 XSS가 작동합니다. 아래에 몇 가지 예가 있으며, 아래와 같은 URL 중 더 많은 취약점이 있을 수 있습니다. 익스플로잇 - 개념 증명 PoC 반사형 XSS Payload : ahrixia"ahrixia Payload Url...

Active-Directory-BadSuccessor

Active-Directory-BadSuccessor 개요 이 룸에서는 Active Directory의 위임된 관리 서비스 계정dMSA을 악용하는 취약점인 BadSuccessor 권한 상승 기법을 살펴봅니다. 이 공격을 통해 dMSA 개체에 대한 충분한 제어 권한을 가진 사용자는 다른 계정을 가장하고 잠재적으로 도메인 관리자 권한을 획득할 수 있습니다. 룸 정보 Room: https://tryhackme.com/room/adbadsuccessor 난이도: 중간 날짜: 05/06/2026 버전: 1.0 목적: 위임된 관리 서비스...

CVE-2026-86443 Cleartext Storage of Sensitive Information Vulnerability

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

EUVD-2026-80326

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-82466

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

EUVD-2026-68123

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

CVE-2026-82466 Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

CVE-2026-82466 Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

EUVD-2026-68109

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

PT-2026-83433

Name of the Vulnerable Software and Affected Versions Omnivore API packages/api versions prior to commit abf53d6 Description An authentication bypass exists in the Apple sign-in token verification process. The decodeAppleToken function extracts the alg field from the JWT header provided by the us...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

EUVD-2026-58500

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...