73 matches found
CVE-2022-24112
CVE-2022-24112 CVE-2022-24112：Apache APISIX apisix/batch-requests RCE nuclei template ：CVE-2022-24112.yaml 这个漏洞本质利用和 CVE-2021-45232 类似，都是绕过授权或未授权，来执行恶意的 route 里的 filterfunc 或者 script 来执行命令 注意是事项 X-Real-IP 的值可以是 127.0.0.1,localhost 或者 2130706433 pipeline 是必须项，以下为其 body 部分的值说明 method 固定为 PUT uri...
WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...
CVE-2022-24112
CVE-2022-24112 Apache APISIX batch-requests RCECVE-2022-24112 root@kitploit: 将目标放入url.txt python3 ApacheAPISIXRCECVE-2022-24112.py Cmd:...
graphql-threat-matrix
GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...
CVE-2022-24112
CVE-2022-24112 Apache APISIX apisix/batch-requests RCE...
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...
CVE-2022-24112_POC
POC 収集したPOC CVE-2022-24112 春秋云境:CVE-2022-24112のターゲット環境を実現するために、2つのPOCを修正しました。M4xSecとtwseptianの両氏のPOCを少し変更し、春秋云境のターゲットに適応させました： 春秋云境:CVE-2022-24112： Apache APISIXは、Apache Software...
Apache-APISIX-CVE-2022-24112
Apache APISIX リモートコード実行 CVE-2022-24112 エクスプロイト 概要 攻撃者は batch-requests プラグインを悪用して、リクエストを送信して Admin API の IP 制限をバイパスできます。 Apache APISIX のデフォルト設定（デフォルトの API キー）は リモートコード実行に対して脆弱です。 管理キーが変更された場合、または Admin API のポートが データパネルとは異なるポートに変更された場合、影響は軽減されます。しかし、Apache APISIX のデータパネルの IP 制限をバイパスするリスクは 依然として存在しま...
Incorrect Authorization
Overview FlaskBB is an A classic Forum Software in Python using Flask. Affected versions of this package are vulnerable to Incorrect Authorization via manipulation of the topicid parameter in batch requests. An attacker can perform unauthorized actions such as locking, unlocking, deleting, or...
PT-2026-57162
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...
GHSA-P84R-H6RX-F2XR parse-server: Server option routeAllowList is bypassable through batch sub-requests
Impact The routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the...
CVE-2026-50008
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as...
CVE-2026-50008 Parse Server: Server option routeAllowList is bypassable through batch sub-requests
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as...
CVE-2026-50008
Parse Server (versions 9.8.0–before 9.9.1-alpha.3) is affected by a bypass in the routeAllowList option. The allow-list check is enforced as Express middleware against the outer HTTP request URL, but the /batch handler dispatches sub-requests to the internal router without re-running the allow-li...
CVE-2026-50008 Parse Server: Server option routeAllowList is bypassable through batch sub-requests
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as...
CVE-2026-44223
vLLM is an inference and serving engine for large language models LLMs. From 0.18.0 to before 0.20.0, the extracthiddenstates speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The...
CVE-2026-30972
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint /batch processes sub-requests internally by...
EUVD-2026-10886
Parse Server has a rate limit bypass via batch request endpoint...
Parse Server has a rate limit bypass via batch request endpoint
Impact Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint /batch processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle...