481099 matches found
CVE-2026-25130-Cybersecurity-AI-CAI-Framework-0.5.10
CVE-2026-25130 – 사이버보안 AICAI 프레임워크 인자 주입 / OS 명령 주입 PoC 작성자: Mohammed Idrees Banyamer 국가: 요르단 GitHub: https://github.com/yourusername Instagram: @banyamersecurity 개요 이 저장소는 사이버보안 AICAI 프레임워크에서 OS 명령 주입으로 이어지는 인자 주입 취약점을 입증하는 PoCProof of Concept를 포함합니다. 이 문제는 findfile 유틸리티에 존재하며, 사용자 입력이 내부 시스템 명령...
CVE-2026-2413-POC
CVE-2026-2413-POC WordPress용 Ally – Web Accessibility & Usability 플러그인은 4.0.3을 포함한 모든 버전에서 URL 경로를 통한 SQL 인젝션에 취약합니다. 이는 getglobalremediations 메서드에서 사용자 제공 URL 매개변수에 대한 이스케이프 처리가 충분하지 않기 때문이며, 해당 매개변수는 SQL 컨텍스트에 대한 적절한 삭제샌니타이제이션 없이 SQL JOIN 절에 직접 연결됩니다. URL 안전을 위해 escurlraw가 적용되지만, 이는 SQL...
CVE-2026-84379
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...
CVE-2026-82522
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
CVE-2026-66786
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...
cve-2025-59489
Unity CVE-2025-59489 취약점 탐지 도구 Android 게임 플랫폼 전용 Unity 런타임 주입 취약점 자동 탐지 도구입니다. 취약점 개요 CVE ID : CVE-2025-59489 CVSS 점수 : 8.4 High 영향 범위 : Unity 2017.1 이상 버전으로 빌드된 Android 앱 공식 공지 : https://unity.com/security/sept-2025-01 취약점 위험 상세 위험 상한 최악의 경우 한 줄 요약 : 공격자가 영향을 받는 Unity 게임/앱을 완전히 제어하고, 해당 앱의 모든 권한...
electroniz3r
electroniz3r electroniz3r로 macOS Electron 앱의 TCC 권한을 탈취하세요. 이 도구는 라스베이거스에서 열린 DEFCON31에서 제 ELECTRONizing macOS privacy - a new weapon in your red teaming armory 발표에서 처음 소개되었습니다. 개요 root@kitploit: $ electroniz3r OVERVIEW: macOS Red Teaming tool that allows code injection in Electron apps by Wojcie...
POC-CVE-2026-63030-CVE-2026-60137-
PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137 -red?style=for-the-badge 📌 개요 Overview WP2Shell 은 WordPress Core 소스 코드의 심각한 취약점 체인Exploit Chain으로, 원격 공격자가 인증 없이Unauthenticated Remote Attacker 서버를 완전히 장악할 수 있게 합니다 Full Server Takeover / RCE. 이 익스플로잇 체인은 두 가지 보안 취약점을 결합합니다: 1. CVE-2026-63030 REST A...
grav-cve-2024-28116
CVE-2024-28116 — Grav CMS의 샌드박스 우회를 동반한 SSTI Grav CMS 1.7.44 이하 버전에서 발생하며 1.7.45 버전에서 수정된, 보안 샌드박스 우회가 가능한 서버 측 템플릿 주입SSTI 취약점인 CVE-2024-28116에 대한 분석 및 Docker 재현 자료입니다. 제보자: Maurizio Siddu akabe1 CVSS v3.1 점수: 8.8 High 패치 버전: Grav CMS 1.7.45 저장소 구조 vulnerable Dockerfile Grav CMS 1.7.44 취약 버전...
EUVD-2026-70247
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...
CVE-2026-66786 Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...
CVE-2026-66786
Submariner 's certificate-based IPsec authentication mode (IPSecCertAuthMode: true) is vulnerable to ipsec.conf stanza injection via remote-supplied CableName and subnets fields in the Custom Resource Definition. Because these free-form strings are incorporated into the connection configuration w...
CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...
CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...
CVE-2026-84379
HTTPX2 , a next-generation HTTP client for Python, is affected by a multipart part header injection vulnerability in FileField.render_headers() within src/httpx2/httpx2/_multipart.py. Prior to 2.11.0 , attacker-controlled content_type values and custom headers from files= tuples are interpolated ...
EUVD-2026-70246
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...
cpanel-malware-cleaner-cve-2026
🚨 cPanel マルウェアクリーナー – CVE-2026-41940 修正ツール 最近の cPanel の脆弱性（CVE-2026-41940 を含む）によって引き起こされるマルウェア感染を検出、除去、防止するための、軽量かつ強力なセキュリティツールです。 🔥 特徴 マルウェア、ボットネット、ウェブシェルを検出・除去します cPanel & WHM のエクスプロイトに関連する脆弱性を修正します ワンコマンドで展開可能 🛡️ 修正対象 このツールは、以下を悪用する攻撃を軽減するために特別に設計されています： CVE-2026-41940（cPanel & WHM / WP2 の脆弱性）...
Exploit for OS Command Injection in Vsftpd_Project Vsftpd
vsFTPd 2.3.4 Exploit Python Proof of Concept for the vsFTPd...
CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
EUVD-2026-70241
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...