cups-script-final-project

What it does Two-stage detection tool for CVE-2025-58060, authentication bypass vulnerability in the Common UNIX Printing System CUPS. Rather than relying on version numbers alone, the tool combines a banner-based version check with an active auth bypass probe. This helps confirming real...

cve-2026-20127

CVE-2026-20127 스캐너 개요 이 프로젝트는 C++로 작성된 Windows 기반 네트워크 스캐닝 도구로, 잠재적인 Cisco SD-WAN / vManage 유사 서비스를 식별하고 CVE-2026-20127로 표시된 참조 이슈에 대한 취약점 점검을 수행합니다. 기능 IP 범위 스캐닝시작 → 종료 IP Cisco SD-WAN / vManage 지표에 대한 서비스 핑거프린팅 HTTP 응답 헤더 및 본문 분석 의심되는 관리 엔드포인트에 테스트 요청 전송 응답 콘텐츠 및 상태 코드 기반 노출 가능성 탐지 간단한 대화형 CLI...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector 무인증 원격 코드 실행 RCE 설명 제품 : MCPJam Inspector 영향을 받는 버전 : ≤ 1.4.2 수정된 버전 : 1.4.3 유형 : 무인증 원격 코드 실행 RCE 공격 경로 : 네트워크 인증 필요 : 아니요 사용자 상호작용 필요 : 아니요 CVSS v3.1 : 9.8 치명적 CVE-2026-23744 는 MCPJam Inspector ≤ 1.4.2 에 영향을 미치는 치명적인 무인증 원격 코드 실행 RCE 취약점입니다. 이 문제는 Inspector가 사용...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x built for htb-nexus 🛠 Quick start and Usage 1. Clone the repository: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.gi...

CVE-2026-28767

CVE-2026-28767: 관리 알림 엔드포인트의 인증 누락 권고 필드| 값 ---|--- CVE| CVE-2026-28767 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 중간 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-306 중요 기능에 대한 인증 누락 연구자| Michael Groberman — Gr0m 게시일| 2026-04-02 Update A 제품 필드| 값 ---|--- 공급업체| Gardyn 제품| Gardyn Home...

PT-2026-102724

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

CVE-2026-73546

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

EUVD-2026-84114

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

CVE-2026-73546: Improper Neutralization of Input During Web Page Generation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

CVE-2026-90941 novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP o...

DEBIAN-CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-85637

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

EUVD-2026-71682

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-85637 jofpin trape Admin Endpoint sockets.py join_room missing authentication

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-85637 jofpin trape Admin Endpoint sockets.py join_room missing authentication

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-85637

jofpin trape (versions 1.0.0/2.0) is affected by a missing authentication flaw in the join_room function within core/sockets.py of the Admin Endpoint component. An unauthenticated remote attacker can exploit this to access the admin endpoint, resulting in low confidentiality impact (CVSS 3.1 base...

PT-2026-86234

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to th...

CVE-2026-85637: Missing Authentication for Critical Function

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...