CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin versions through 1.0.1 is vulnerable to an unauthenticated arbitrary order status change via IPN callback. The root cause is a failure to require a shared secret for validating incoming payment notification requests. If the secret remains at its default ...

log4shell-exploitation-detection

Log4Shell CVE-2021-44228 漏洞利用、检测与修复 一个实战型攻防安全项目，模拟 Log4Shell 漏洞的完整生命周期：从攻击者控制的虚拟机进行漏洞利用、在 Splunk 中进行检测工程，以及验证修复方案。 项目动机 该领域的大多数作品集项目都只涉及 SSH 暴力破解。我想做一个能展示更全面技能的项目：端到端地利用一个真实的高影响 CVE，然后转向防御侧进行检测和修复，这正是安全工程师或检测工程师在实际工作中经历的完整生命周期。 环境 攻击机： Kali Linux 虚拟机 192.168.1.86 目标机： Linux Mint 虚拟机，主机名 illshot...

CLEANSTART-2026-AU10912 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

CVE-2026-39835 affects multiple packages. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. See references for individual vulnerability details...

CVE-2026-33017

我对 CVE-2026-33017 的简单 bash 实现。 详细说明请查看以下链接：https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx 使用 nc -lvnp PORT 接收 shell 回调...

PT-2026-106359

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

CVE-2026-102295

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study 针对 Palo Alto PAN-OS GlobalProtect 门户的 CVE-2024-3400 利用尝试的检测、分析与响应策略。包含 IOC、利用模式及缓解指南。 CVE-2024-3400 事件调查 🔍 概述 本仓库包含对 CVE-2024-3400 的详细调查与威胁分析。CVE-2024-3400 是一个影响 Palo Alto Networks PAN-OS 软件、专门针对 GlobalProtect 门户的严重未授权命令注入漏洞。 2024 年 4 月 18 日，在一台内部 PAN-OS...

CVE-2026-102295

A cross-site scripting (XSS) vulnerability exists in Quay within the OAuth callback handler (specifically via the oauth local callback format=json parameter). The root cause is improper input sanitization , which allows a remote attacker to execute arbitrary JavaScript in a user's browser by tric...

CVE-2026-102295 Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295 Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

EUVD-2026-92518

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2023-38146

针对 ThemeBleed CVE-2023-38146 漏洞利用的 PoC（Windows 11 主题） 深受 https://github.com/gabe-k/themebleed 的启发，该工具仅能在 Windows 上运行（这也是我决定编写本工具的原因）。 使用了来自 impacket smbserver.py 的修改代码 https://github.com/fortra/impacket/blob/master/impacket/smbserver.py...

CVE-2025-24813

CVE-2025-24813 CVE-2025-24813 の簡単な再現・分析と、簡単なエクスプロイトスクリプトを作成しました。 usage: CVE-2025-24813.py -h -u URL -d DATA CVE-2025-24813 optional arguments: -h, --help show this help message and exit -u URL, --url URL URL -d DATA, --data DATA base64serialdata 例 vulhub を使用して脆弱性のあるサービスを起動し、urldns チェーンでペイロードを生成しま...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/crypto

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/crypto. CVE-2026-56854 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-56854 DESCRIPTION: The source-address critical option in the...

CallStranger

CallStranger 此脚本由 Yunus Çadırcı（https://twitter.com/yunuscadirci）创建，用于检测 CallStranger（CVE-2020-12695）漏洞。攻击者可利用此漏洞进行： 绕过 DLP 以窃取数据 利用数百万面向互联网的 UPnP 设备作为放大反射式 TCP DDoS / SYN Flood 的源 从面向互联网的 UPnP 设备扫描内部端口 该脚本仅模拟数据窃取。 详细信息请访问 https://www.callstranger.com https://kb.cert.org/vuls/id/339275...

Astra Linux – Vulnerability in curl

There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevents VMA splitting of buffer mappings. The perfmmap code is careful to map the user page using mmap along with the ringbuffer and the auxiliary buffer, when the event supports this. Once the first mapping is...