CVE-2024-10410

Source code Online Hotel Reservation System in PHP/MySQLi with Source Code | SourceCodester Description A high risk vulnerability was found in Online Hotel Reservation System, affecting the upload function of /marimar/admin/modroom/controller.php file. The bypass detection operation of image...

CVE-2026-34835-Black-box-Analysis

本仓库从外部渗透测试者的视角，对 CVE-2026-34835 进行了黑盒安全分析。 目标并非逆向分析该漏洞，而是记录安全评估人员在授权评估期间如何识别、验证并评估其影响。 CVE-2026-34835（Rack Host Header Bypass）黑盒分析 从动态应用安全测试（DAST）的角度审视 CVE-2026-34835 ，这是一个中等严重性的验证绕过漏洞。 本报告以外部黑盒渗透测试的视角评估该漏洞的表现方式，严格关注可观察的行为及应用响应异常。 📌 漏洞概述 CVE ID: CVE-2026-34835 组件: Rack::Request 处理逻辑 漏洞类型:...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Apache Camel 实战利用实验室 🔍 概述 CVE-2025-27636 是 Apache Camel 中一个严重的远程代码执行 RCE 漏洞，具体位于 camel-exec 组件。它源于一个微妙但危险的问题： DefaultHeaderFilterStrategy 对标头名称执行区分大小写的检查，可以使用替代大小写来绕过。 这意味着内部 Camel 标头（例如 CamelExecCommandExecutable）如果大小写被篡改（例如 cAmeLexecCommandExecutable），本应被阻止的它们也可能通过。 当此标头到达...

claude-create-CVE-2025-29927

Next.js 中间件漏洞测试工具 CVE-2025-29927 此应用程序演示了 Next.js 中间件授权绕过漏洞 CVE-2025-29927。 关于该漏洞 CVE-2025-29927 是 Next.js 中间件中的一个授权绕过漏洞。通过发送一个精心构造的 HTTP 头 x-middleware-subrequest，攻击者可以绕过在中间件中实现的授权检查，从而获得对受保护资源的访问。 设置说明 1. 安装依赖： root@kitploit: cd /var/www/react-nextjs/test-middleware-skip npm install 2. 启动开发服务器：...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; fflcockpitisallowed 函数使用一个硬编码的 IP 地址（base64：My4yMTIuMTg1LjE4Nw==，解码后：3.212.185.187），该地址在插件源代码中可见。 来自 class-sync-endpoint.php 的漏洞代码片段： root@kitploit: 11...

CVE-2026-85547

CVE-2026-85547 is a cross-site request forgery (CSRF) vulnerability in MISP (Malware Information Sharing Platform). The root cause is that MISP's _isRest() check disables form-security and CSRF protections when a request is identified as REST, but this detection can be manipulated by an attacker-...

UBUNTU-CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-72578

CVE-2026-72578 concerns FreePBX Framework 17.0. The vulnerability is a CSRF weakness in the /admin/ajax.php dispatcher (amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php) where no CSRF tokens are implemented; protection relies solely on a Referer header, which can be bypassed when no Referer hea...

Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

MGASA-2026-0327 Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

CVE-2026-48061

Litestar prior to v2.22.0 is affected by CVE-2026-48061: AllowedHostsMiddleware may bypass host validation by using X-Forwarded-Host when Host is absent, enabling host-header injection (e.g., password reset links, cache keys, routing decisions). The issue occurs when no reverse proxy strips X-For...

CVE-2026-63732

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service...

CVE-2026-62312

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

SUSE-SU-2026:3059-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service bsc1261320. - CVE-2026-34513: unbounded DNS cache can cause a denial of service bsc1261321. - CVE-2026-34514: contenttype parameter manipulation can lead ...

PT-2026-60306

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description A remote authenticated attacker can achieve arbitrary code execution on the host operating system. This is possible by combining a Host header bypass of localhost-only routes with unvalidated MCP...