728 matches found
scansploit
=SCANSPLOIT= 악성 페이로드를 바코드에 주입하기 위한 도구 바코드 code128 QR코드 DataMatrix EAN13 요구 사항 Python3 PyStrich pip3 install pystrich JPEG 오류 시: sudo apt-get install libtiff5-dev zlib1g-dev libfreetype6-dev liblcms2-dev libwebp-dev tcl8.6-dev tk8.6-dev python-tk Pillow pip3 install pillow...
AAMVA-PDF417-Vulnerability-Research
PDF417 ID 검증 취약점 연구 개요 이 저장소는 정부 신분증, 기업 솔루션 및 소비자 애플리케이션에 영향을 미치는 AAMVA 표준 PDF417 바코드 검증 시스템의 심각한 취약점을 문서화한 포괄적인 보안 연구를 포함합니다. 이 연구는 ID 검증 시스템이 운전면허증 바코드를 처리하는 방식의 체계적인 결함을 입증하는 완전한 기능의 개념 증명PoC을 포함합니다. 중요: 이 코드는 보안 연구 목적으로만 제공됩니다. 허용된 사용법은 LICENSE.md 파일을 참조하세요. 연구 윤리 진술 이 연구는 다음 원칙을 준수하여 수행되었습니...
CVE-2026-61744
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...
CVE-2026-61744
InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...
CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...
CVE-2026-61744: Authorization Bypass Through User-Controlled Key
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...
CVE-2026-86737
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
Missing Authorization
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the GET /hardware/asset/barcode endpoint. An attacker can access barcodes and enumerate asset tags across tenants, including soft-deleted and...
CVE-2026-86737
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. An authenticated attacker can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets. The vulnerability i...
EUVD-2026-72873
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
PT-2026-87134
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-86737: Missing Authorization
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...
CVE-2026-81280
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...
EUVD-2026-68776
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...
CVE-2026-81280
Print Barcode Labels for your WooCommerce products/orders is a WordPress plugin vulnerable to Sensitive Data Exposure in versions 4.0.0 and below . The vulnerability requires Subscriber-level privileges (low) and can be exploited over the network with low complexity and no user interaction, resul...
CVE-2026-81280 WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...
CVE-2026-81280 WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...