5MMISSI-CVE-2017-1000499

5MMISSI-CVE-2017-1000499 CVE-2017-1000499의 PoC phpMyAdmin 4.7.x 버전4.7.6.1/4.7.7 이전은 CSRF 취약점에 노출되어 있습니다. 사용자를 속여 조작된 URL을 클릭하게 함으로써 레코드 삭제, 테이블 드롭/트렁케이트 등과 같은 유해한 데이터베이스 작업을 수행할 수 있습니다. 내용 Makefile web/index.html 지침 사전 준비 git clone https://github.com/Villaquiranm/5MMISSI-CVE-2017-1000499.git cd...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (crlsa-2026_6473)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266473 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2026_6286)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266286 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2026_6281)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266281 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

CVE-2025-29927-NextJS

📦 Next.js CVE-2025-29927 - 개념 증명 이 저장소에는 CVE-2025-29927을를 악용하기 위한 최소한의 개념 증명PoC이 포함되어 있습니다. 해당 취약점은 특정 버전의 Next.js에 영향을 미치는 높은 심각도의 취약점으로, 조작된 URL을 통해 내부 애플리케이션 파일에 대한 무단 접근을 허용합니다. ⚠️ 면책 조항 이 코드는 교육 및 승인된 보안 연구 목적 으로만 제공됩니다. 소유하지 않았거나 명시적 테스트 허가를 받지 않은 시스템에서 사용하지 마십시오. 🚀 시작하기 🔧 사전 요구 사항 Docker Gi...

CVE-2025-15490

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-15490

Passster WordPress plugin versions before 4.2.26 contain a flaw in its global protection checks , enabling unauthenticated users to bypass the plugin's protection mechanism via crafted URLs. The impact is rated Medium (CVSS 5.3) with a low confidentiality impact and no integrity or availability i...

CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

EUVD-2025-210832

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

PT-2026-84713

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

DEBIAN-CVE-2026-18487

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

Linux Distros Unpatched Vulnerability : CVE-2026-66754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to...

SAP NetWeaver AS Java XSS in Configuration Wizard (3748227)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3748227: - SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafte...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webfetch function in the IPv4 Handler component when processing the url argument. An attacker can access internal resources, exfiltrate sensitive data, or perform unauthorized actions by supplyin...

EUVD-2026-43587

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

PT-2026-57938

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

CVE-2026-44752: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

CVE-2026-57584 Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier /., and the same construct is produced by the /:params placeholder and the CLI...