php-app-race-condition

脆弱なPHPアプリ（競合状態） 環境構築: docker-compose up 環境検証: 接続テスト: http://localhost/test.php 脆弱なエンドポイント: http://localhost/poc.php 競合状態のエクスプロイト: echo http://localhost | nuclei -t race.yml 残高から引き出しとして計上されたのは1280$未満であることが確認できます（10$ 128リクエスト）。純利益は変動します。 参考: https://defuse.ca/race-conditions-in-web-applications.htm...

padding-oracle-attacker

padding-oracle-attacker CLIツールとライブラリで、パディングオラクル攻撃を簡単に実行できます。同時ネットワークリクエストをサポートし、洗練されたUIを備えています。 インストール Node.jsがインストールされていることを確認し、次に以下のコマンドを実行してください。 $ npm install --global padding-oracle-attacker または $ yarn global add padding-oracle-attacker CLIの使い方 使い方 $ padding-oracle-attacker decrypt hex:...

CVE-2024-53476

CVE-2024-53476 説明 SimplCommerceはチェックアウトロジックに競合状態の脆弱性が存在し、同時チェックアウトリクエストにより複数のユーザーが在庫以上の商品を購入できる脆弱性です。 検出方法 攻撃者は、在庫が限られている（在庫=1）商品を、2つのアカウントを使用してほぼ同時に購入しようとすることでこの脆弱性を検出できます。両方のアカウントが商品の購入に成功した場合、競合状態の存在が確認されます。これは、カスタムスクリプトやBurp SuiteのTurbo Intruderを使用して同時チェックアウトリクエストを送信することで実行できます。 テスト対象...

strutser

strutser このプログラムは CVE-2017-5638 をチェックします。 使い方 Usage of ./strutser: Usage of ./strutser: -c, --concurrency int Concurrent HTTP requests. default 10 -f, --file string File containing targets -p, --ports intSlice Ports to check. default 80 -t, --timeout int Timeout on HTTP requests. default 15 ヒント...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...

CVE-2026-36958

CVE-2026-36958: 同時HTTPリクエストによるサービス拒否 CVE ID: CVE-2026-36958 日付: 2026-04-29 発見者: Kirubel Solomne ベンダー: U-SPEED 製品: U-SPEED ルーター ファームウェアバージョン: V1.0.0 CWE: CWE-400 - 制御されないリソース消費 説明 U-SPEED ルーターのファームウェア V1.0.0 はサービス拒否に対して脆弱です。Web管理インターフェース上のランダムまたは存在しないエンドポイントに対して大量の同時HTTPリクエストを送信することで、攻撃者は組み込みの Boa...

CVE-2026-79625

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

Exposure Of Data Element To Wrong Session

org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...

CVE-2021-41773

Usage usage: main.py -h -f FILE -s N --timeout SECONDS optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File containing target URLs one per line -s N, --semaphore N Concurrent requests default: 10 --timeout SECONDS Request timeout in seconds default: 10...

CVE-2026-93840: Improper Validation of Array Index

vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...

CVE-2026-45720

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-86766

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

EUVD-2026-74921

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-87816

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...