124 matches found
CVE-2025-27636-Apache-Camel-PoC
Apache Camel CVE-2025–27636 & CVE-2025-29891 PoC CVE-2025–27636 and CVE-2025-29891 are vulnerabilities in Apache Camel that affect versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods. The following is a...
cve-2026-19478
CVE-2026-19478 — GitLab GraphQL @glintroduced version-filter vulnerabilities A reproduction lab for two related bugs in GitLab's GraphQL version-filter feature the @glintroduced directive. Both live in the same feature area, are fixed by the same upstream patch, and both let a GraphQL request rea...
CVE-2026-5173
🦊 CVE-2026-5173: GitLab WebSocket Unauthorized Method Execution PoC 🛠️ Overview CVE-2026-5173 allows a low-privileged authenticated attacker to call restricted backend methods through GitLab's WebSocket /-/cable endpoint, specifically via the GraphqlChannel. This can lead to sensitive data exposur...
EUVD-2026-85344
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...
CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...
CVE-2026-46636: Improper Neutralization of Special Elements Used in a Template Engine
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a...
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
CVE-2026-33286
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
CVE-2026-33286
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
CVE-2026-33286: Improper Control of Dynamically-Managed Code Resources
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
CVE-2026-33286
CVE-2026-33286 (Graphiti) affects Graphiti prior to 1.10.2. The vulnerability arises because Graphiti::Util::ValidationResponse#all_valid? calls model.send(name) using relationship names directly from user-supplied JSONAPI payloads during write operations (create/update/delete) without validating...
CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Summary An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations...
GHSA-3M5V-4XP5-GJG2 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Summary An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations...
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Summary An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations...
PT-2026-26750
Name of the Vulnerable Software and Affected Versions Graphiti versions prior to 1.10.2 Description Graphiti is a framework that exposes models through a JSON:API-compliant interface. Versions prior to 1.10.2 contain a flaw where an attacker can construct a malicious JSONAPI payload with arbitrar...