cve-2026-29204-whmcs-clientarea-addonid

CVE-2026-29204 — WHMCS 客户端区域附加组件防护 关于 CVE-2026-29204 的非官方社区说明：在 clientarea.php?action=productdetails 上，已登录客户端可以提供外部的 addonId 以及 modop=custom，从而访问不属于该会话的模块上下文。 请先升级。 应用供应商修补过的 WHMCS 版本（支持的分支上的 8.13.3 或 9.0.4 ）。参见 8.13 和 9.0 变更日志。 mitigation/ 中的钩子是一个临时的、可选的 客户端区域防护。它不是 供应商补丁，也不是...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90454

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90454

A read-only deployment mode for a product with a bundled packet-analysis component (per the CISA ICS-CERT advisory reference) uses a pattern-based deny list to block write-capable routes, but the pattern omits routes that modify tags on stored session records . Since the proxy otherwise permits t...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90450

CVE-2026-90450 is a fail-open authorization flaw in which the application's role-authorization lookup grants access by default when a request handler is not present in its table of role requirements. Consequently, any request handler not explicitly registered in the table is reachable by any auth...

CVE-2026-90448

CVE-2026-90448 affects a read-only deployment mode that proxies a set of API routes without restricting allowed request methods. One of these routes accepts a request that creates or overwrites a stored record with an attacker-chosen identifier, using the application's own elevated backend creden...

CVE-2026-90447

This ICS-CERT advisory (CSAF reference: ICSA-26-254-01) describes a privilege escalation vulnerability in a downstream service where a routing rule selects between two authentication mechanisms based on a client-supplied request header . An authenticated user possessing a shared service credentia...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

auto-repeater

AutoRepeater：使用 Burp Suite 自动重放 HTTP 请求 摘要 在扩展器中导入 AutoRepeater.jar 简要说明 AutoRepeater 只会重发那些被已定义替换所更改的请求。当 AutoRepeater 收到一个符合某个标签页所设置条件的请求时，AutoRepeater 会首先将所有已定义的基础替换应用到该请求上，然后针对每个已定义的替换，先复制已执行基础替换的请求，再将相应的替换应用到该请求上。 简介 Burp Suite 是一个拦截型 HTTP 代理，也是进行 Web 应用安全测试的事实标准工具。虽然 Burp Suite...

CVE-2026-54258 Cross-monitor event media authorization bypass in direct event media endpoints

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-54258

ZoneMinder , a free open-source closed-circuit television (CCTV) application, is affected by an authorization bypass in direct event media endpoints. In versions prior to 1.36.39 , 1.38.4 , and 1.39.11 , an authenticated low-privileged user holding only coarse Events=View and/or Snapshots=View pe...

Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

GHSA-2CG9-97GQ-9MQP Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...