Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted 'x-middleware-subrequest' header, which can lead to authorization bypass and other securit...

Oracle WebLogic Server Administration Console - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...

day10-nextjs-middleware-lab

दिन 10 — Next.js middleware auth-bypass lab CVE-2025-29927 सिमुलेशन महत्वपूर्ण: केवल शैक्षिक प्रयोगशाला। Docker में स्थानीय रूप से चलाएं। त्वरित प्रारंभ: root@kitploit: npm i build from repo root with files above docker build -t day10-nextjs-lab . run docker run --rm -d -p 8080:3000 --name day10...

cloud-middleware-dataset

Cloud-Middleware-Datensatz Dieses Projekt enthält Cloud-Middleware d. h. Agenten, die von Cloud-Sicherheitsanbietern installiert werden, die bei den großen Cloud-Dienstanbietern Azure, AWS und GCP zum Einsatz kommt. Der Cloud-Middleware-Datensatz listet alle Agenten auf, die von den großen...

next-CVE-2025-29927

CVE-2025-29927: Autorisierungsumgehung in der Next.js-Middleware Eine kritische Schwachstelle in Next.js CVE-2025-29927 ermöglicht unbefugten Zugriff auf geschützte Routen, indem die Middleware-Logik umgangen wird. Das Problem betrifft Next.js-Versionen 11.1.4 bis 13.5.6 sowie Versionen 14.x...

CVE-2025-29927_Scanner

CVE-2025-29927 Checker 📌 Introduzione Questo script verifica la vulnerabilità CVE-2025-29927 nei server Next.js testando più payload nell'header x-middleware-subrequest per rilevare accessi non autorizzati. ❓ Cos'è CVE-2025-29927? CVE-2025-29927 è una vulnerabilità che consente di aggirare le...

CVE-2025-29972

CVE-2025-29927 - Vulnerabilità di sicurezza critica in Next.js Panoramica CVE-2025-29927 è una vulnerabilità di sicurezza critica che colpisce Next.js , un popolare framework React per la creazione di applicazioni web full-stack. Questa falla consente agli attaccanti di bypassare i controlli di...

middleware-auth-bypass

middleware-auth-bypass CVE-2025-29927 una poc del bypass dell'autenticazione middleware di next.js...

cve-2025-29927-lab

CVE-2025-29927 Labor Minimales Reproduktions-Labor für CVE-2025-29927 — Next.js Middleware-Autorisierungsumgehung CVSS 9.1. Begleitmaterial zu: N-Day-Analyse auf Medium Was dies ist Eine Next.js 15.2.2-App angreifbar mit einer cookie-geschützten /dashboard-Route. Die...

CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...

CVE-2026-76844

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

EUVD-2026-64850

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 Un template di Nuclei per rilevare CVE-2025-29927, la vulnerabilità di bypass dell'autenticazione di Next.js. Se vuoi capire esattamente come funziona questa vulnerabilità, puoi leggere l'ottimo articolo dei ricercatori originali qui Questo template è abbastanza semplice. Fa...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

oauth2-proxy

OAuth2 Proxy è uno strumento open-source flessibile che può fungere da reverse proxy autonomo o da middleware integrato in configurazioni di reverse proxy o load balancer esistenti. Fornisce un modo semplice e sicuro per proteggere le tue applicazioni web con l'autenticazione OAuth2 / OIDC. Come...

nullorigin

NullOrigin 🛡️ Middleware universale per la provenienza AI e la sanificazione dei watermark Artefatto di ricerca — solo per la valutazione della robustezza del watermarking. 🔬 Solo uso di ricerca NullOrigin è un artefatto di ricerca. Viene pubblicato per supportare lo studio accademico e...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...