CVE-2024-43917

CVE-2024-43917 このスクリプトは、WordPress用プラグインTI WooCommerce Wishlist バージョン2.8.2までで発見されたSQLインジェクションの脆弱性（CVE-2024-43917）を実証します。この脆弱性により、認証されていないユーザーがウェブサイトのデータベース上で任意のSQLコマンドを実行でき、ユーザー名やパスワードなどの機密情報が漏洩する可能性があります。 使用方法 必要なPython依存関係をインストールします: bash pip install requests スクリプト内のtargeturlを脆弱なサイトのURLに置き換えてくださ...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138

The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin QA Analytics versions = 5.3.0.0...

ES-File-Explorer-Open-Port-Vulnerability---CVE-2019-6447

このリポジトリには README がありません。...

CVE-2022-37177

CVE-2022-37177 - HireVueの脆弱なまたはリスクのある暗号アルゴリズム...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

CVE-2026-105876

The WordPress Modula Image Gallery plugin (versions up to and including 3.0.11 ) contains a Missing Authorization vulnerability (CWE-862) within the modula-best-grid-gallery component. This flaw allows an attacker to Retrieve Embedded Sensitive Data from the plugin. No specific remediation steps ...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin Modula Image Gallery versions = 3.0.11...

EUVD-2026-94213

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

CVE-2025-14847

📝 MongoDB 扫描器 – 运行说明 脚本名称 mongoexposurescanner.py 1. 前提条件 Python 3.9+ 对目标主机的网络访问 已批准的扫描范围 验证 Python： python3 --version 2. 使用的文件 文件| 用途 ---|--- mongoscanner.py| 扫描器脚本 targets.txt| 目标主机和端口 mongoexposedtargets.txt| 扫描结果（自动创建） 3. 目标文件格式（targets.txt） 支持的格式： Host only default ports used 10.99.1.52...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

CVE-2026-104849

A flaw was found in tinypool. When processing tasks with caller-supplied configuration options, the worker pool does not verify whether properties, such as the worker filename, belong directly to the provided object. An attacker who can manipulate shared JavaScript base objects prototype pollutio...

CVE-2025-12721

g-FFL Cockpit 'returntrue'，使其对任何未经身份验证的访问者完全可访问。 位于 class-sync-endpoint.php 中： 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', // 公共端点 92: ; handleserverstatus 函数暴露： 服务器信息 ：PHP...

gitlab-component

gitlab-component はじめに GitLab をすぐに使い始められるよう、推奨される次の手順をリストにしました。 すでにプロですか？この README.md を編集して自分好みに変更しましょう。簡単にしたいですか？下部のテンプレートを使用してください！ ファイルを追加する ファイルを作成 または ファイルをアップロード する コマンドラインを使用してファイルを追加 するか、以下のコマンドで既存の Git リポジトリをプッシュします： cd existingrepo git remote add origin...

CVE-2025-68664

CVE-2025-68664 这一切我想在圣诞节得到的就是你们的秘密：LangGrinch 袭击了 LangChain 核心 CVE-2025-68664 作者：亚尔登·波拉特 Cyata 研究：LangChain 中的 LangGrinch 漏洞 已发布：https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨天，LangChain 发布了一个关于我在 langchain-core 中发现的漏洞的关键警告：CVE-2025-68664 / GHSA-c67j-w6g6-q2cm。...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...