CVE-2025-61882

Oracle E-Business Suite RCE スキャナー CVE-2025-61882 Oracle E-Business Suite インストール環境における CVE-2025-61882 を検出するための、高速でマルチスレッド対応の一括スキャナーです。この重大な脆弱性により、認証なしのリモートコード実行が可能になります。 🎯 特徴 一括スキャン - ファイルから数百〜数千のターゲットを処理 マルチスレッド - 同時スキャン数を設定可能（デフォルト: 20スレッド） 自動検出 - id コマンドを実行し、出力を解析して RCE を検証 リアルタイム結果 -...

Blackash-CVE-2025-61884

CVE-2025-61884 新 Oracle E-Business Suite 漏洞可让黑客无需登录即可访问数据 💀 CVE-2025-61884 — 完整摘要 🧾💥 字段| 详情 ---|--- 标识符| CVE-2025-61884 产品| Oracle E-Business Suite — Oracle Configurator（运行时界面） 受影响版本| 12.2.3 → 12.2.14 攻击向量| 网络（HTTP）— 未认证 访问 影响| 机密性（未经授权的数据泄露） CVSSv3.1 基础评分| 7.5（高危） — AV:N/AC:L/PR:N/UI:N/C:H/I:N/A...

CVE-2026-25126

CVE-2026-25126: PolarLearn 投票数改ざん 研究: Joshua van Rijswijk 説明 CVE-2026-25126 の PoC。これは、PolarLearn フォーラム投票 API における深刻度の高いビジネスロジックの脆弱性です。 エンドポイント POST /api/v1/forum/vote は、direction フィールドの厳格な実行時検証を実施できていません。 TypeScript の型は実行時に強制されないため、攻撃者は任意の文字列を送信でき、それが後続処理で誤って処理されます。 これにより、いわゆる ゴーストダウンボート...

http-oracle-ebs-cve-2025-61882.nse

http-oracle-ebs-cve-2025-61882.nse Oracle E-Business Suite（CVE-2025-61882）を検出します。検出方法：多層チェック — フィンガープリンティング、バージョン確認、エンドポイント＆SSRFテスト、タイミング分析＆制御された悪用による4つの高信頼性結果。デフォルト＝安全なフィンガープリンティングのみ。aggressive=true を設定するとアクティブ/プロービングチェックが有効になり、注意して使用してください。提供：BattalionX [email protected]...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Oracle E-Business Suite 事前認証RCEエクスプロイト Oracle E-Business Suite（バージョン12.2.3〜12.2.14）における重大な事前認証リモートコード実行（RCE）の脆弱性により、攻撃者は悪意のあるHTTPリクエストを介して脆弱なサーバーを完全に制御できる可能性があります — 現在、実環境で活発に悪用されています。 TL;DR CVE-2025-61882 は、Oracle E-Business Suite（EBS） における重大な事前認証RCE...

Blackash-CVE-2025-61882

🛡️🚨 CVE‑2025‑61882 — Oracle E‑Business Suite EBS における重大な事前認証リモートコード実行 🚨🛡️ 概要: Oracle E‑Business Suite EBS における重大な事前認証リモートコード実行 — 12.2.3 → 12.2.14 に影響、CVSS 9.8 、実環境で活発に悪用（ランサム/恐喝活動が報告済み）。（oracle.com1） 📌 クイックファクト（表） 項目| 詳細 ---|--- 🆔 CVE| CVE‑2025‑61882 🧾 製品 / コンポーネント| Oracle E‑Business Suite EBS —...

CVE-2026-7175

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

EUVD-2026-90745

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

CVE-2026-7175

The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for September 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF003, 25.0.0-IF007 and 24.0.0-IF009. These vulnerabilities have been also addressed in 24.0.1-IF009 Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7 is vulnerable to...

CVE-2026-97661

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-97661

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.2.1 . The root cause is insufficient input sanitization and output escaping within the 'gateway' Form Field . An unauthenticated attacker can inject...

CVE-2026-97661 Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-90574

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2025-209818

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the getsponsoredmeta AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protect...

CVE-2026-102107

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used t...

CVE-2026-102107 Kiteworks Core user impersonation in a file-request feature

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used t...

CVE-2026-102107 Kiteworks Core user impersonation in a file-request feature

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used t...

CVE-2026-102107

Kiteworks Core contains a business logic flaw within its file-request feature. This flaw allows an authenticated user to send requests that appear to originate from a different user because the server fails to verify if the requester is authorized to act as the specified account. An attacker coul...

CVE-2026-62097

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...