CVE-2026-53625-GLPI-PoC

CVE-2026-53625 - GLPI authtype 조작을 통한 권한 상승 PoC 📌 개요 이 저장소는 CVE-2026-53625 에 대한 윤리적 개념 증명PoC을 제공합니다. 이 취약점은 GLPI 0.70부터 11.0.7까지의 모든 버전에 영향을 미치는 높음High 심각도 권한 상승 취약점입니다. 낮은 권한의 사용자Technician는 REST API를 통해 authtype 필드를 조작하여 Super-Admin을 포함한 모든 계정을 완전히 제어할 수 있습니다. 이 공격은 세 가지 약점을 연쇄적으로 이용하여 완전한 계정 탈...

CVE-2025-29927

Next.js 취약점 데모 CVE-2025-29927 이 저장소는 Next.js 15.2.2 및 이전 버전에 영향을 미치는 Next.js 취약점 CVE-2025-29927의 데모를 포함하고 있습니다. 이 취약점을 통해 공격자는 x-middleware-subrequest 헤더를 설정하여 미들웨어 인증 검사를 우회할 수 있습니다. 저장소 구조 이것은 두 개의 Next.js 애플리케이션이 포함된 NX 모노레포입니다: 1. vulnerable-app : 취약점이 있는 Next.js 15.2.2 사용 2. fixed-app : 수정 사...

CVE-2025-29927

소개 x-middleware-subrequest 요청 헤더를 위조하여 Next.js 미들웨어 인증 메커니즘을 우회하고, 보호된 라우트에 대한 무단 액세스를 허용합니다. 환경 구성 프로젝트 소스 코드는 P神에서 가져온 것이며, Next.js 버전은 15.2.2입니다Next.js 15.x의 경우 이 문제는 15.2.3에서 수정되었습니다. 취약점 환경 Node와 npm이 설치되어 있는지 확인하세요. 다음 명령어로 버전을 확인합니다: root@kitploit: node -v npm -v 의존성을 설치하고 프로젝트를 시작합니다...

CVE-2026-35616

CVE-2026-35616 - FortiClient EMS 사전 인증 API 우회를 통한 RCE 요약 Fortinet FortiClient EMS 7.4.5 및 7.4.6 의 치명적인 인증 우회 취약점으로 인해 완전히 인증되지 않은 원격 공격자가 단일 HTTP 헤더X-SSL-CLIENT-VERIFY를 스푸핑하여 API 인증을 우회할 수 있습니다. 이 결함은 Django 미들웨어가 신뢰할 수 있는 리버스 프록시뿐만 아니라 사용자 제어 헤더의 클라이언트 인증서 메타데이터를 신뢰하기 때문에 발생합니다. 이를 통해 공격자는 전체 관리...

CVE-2026-74882

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-14450

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

CVE-2026-14450

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-25552

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

PT-2026-66778

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

GO-2026-5966 File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser

File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser...

GHSA-XQP3-JQ6G-X3QM File Browser: Authentication Bypass via Proxy Auth Header Forgery

Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...

File Browser: Authentication Bypass via Proxy Auth Header Forgery

Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...