CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CVE-2026-71324

A flaw was found in Traefik. Traefik's HTTP reverse proxy can improperly handle HTTP/2 or HTTP/3 CONNECT requests forwarded to an HTTP/1.1 upstream. If the upstream sends a keep-alive non-2xx response and does not fully drain the body, the desynchronized backend socket is returned to a shared poo...

CVE-2025-29972

CVE-2025-29927 - Vulnerabilità di sicurezza critica in Next.js Panoramica CVE-2025-29927 è una vulnerabilità di sicurezza critica che colpisce Next.js , un popolare framework React per la creazione di applicazioni web full-stack. Questa falla consente agli attaccanti di bypassare i controlli di...

CVE-2025-29927-Testing

CVE-2025-29927 के लिए परीक्षण स्क्रिप्ट, CyberMaxx द्वारा प्रदान की गई। CVE-2025-29927 परीक्षक यह PowerShell स्क्रिप्ट सुरक्षा शोधकर्ताओं और सिस्टम प्रशासकों को Next.js अनुप्रयोगों में CVE-2025-29927 कमजोरियों का परीक्षण करने में मदद करने के लिए डिज़ाइन की गई है। यह जाँच करता है कि कोई लक्ष्य...

nextjs-middleware-bypass-demo

CVE-2025-29927 Demo Originalbericht: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Einrichtung Führen Sie zuerst den Entwicklungsserver aus: root@kitploit: npm i npm run dev Öffnen Sie http://localhost:3000 in Ihrem Browser, um das Ergebnis zu sehen...

CVE-2025-29927-PoC

CVE-2025-29927: PoC di Bypass del Middleware di Next.js Questo repository dimostra la vulnerabilità CVE-2025-29927 in Next.js, dove l'header interno x-middleware-subrequest può essere utilizzato per bypassare i controlli del middleware come l'autenticazione. Versioni Affette Next.js 15.x 15.2.3...

middleforce

MiddleForce 🔍 Panoramica MiddleForce è uno strumento specializzato per test di sicurezza progettato per rilevare e sfruttare la vulnerabilità CVE-2025-29927 nel middleware di Next.js. Questo strumento aiuta i professionisti della sicurezza a identificare applicazioni vulnerabili ad attacchi di...

PX4-Autopilot

Der Autopilot-Stack, auf den die Branche baut. Über PX4 ist ein Open-Source-Autopilot-Stack für Drohnen und unbemannte Fahrzeuge. Er unterstützt Multikopter, Starrflügler, VTOL, Rover und viele weitere experimentelle Plattformen – von Rennquads bis zu industriellen Vermessungsflugzeugen. Er läuft...

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting

The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2....

0xMiddleware

CVE-2025-29927: Exploração de Middleware no Next.js Esta ferramenta demonstra e automatiza a exploração de CVE-2025-29927 , uma vulnerabilidade no Next.js que permite a um atacante contornar verificações de middleware como autenticação abusando do cabeçalho interno x-middleware-subrequest. 🔧 Como...

NextSecureScan

NextSecureScan - Next.js CVE-2025-29927 中间件漏洞扫描器 NextSecureScan 是一款全面的安全扫描器，专门设计用于识别 Next.js 应用程序中与中间件相关的授权绕过漏洞（CVE-2025-29927）。该扫描器利用显式头部操作技术、中间件重定向检测以及高级多语言绕过方法，提供彻底的漏洞评估。 🛡️ 功能特性 中间件检测 ：通过标准及高级 HTTP 头部检查（x-middleware-rewrite、x-middleware-set-cookie）显式检测 Next.js 中间件的使用情况。 重定分析 ：清晰识别中间件触发的重定向（HTT...

poc-cve-2025-29927

Bypass del Middleware di Next.js CVE-2025-29927 Proof of Concept Questo repository contiene un proof of concept POC per CVE-2025-29927 , una vulnerabilità critica in Next.js che consente agli attaccanti di bypassare i controlli di autorizzazione implementati nel middleware. 📋 Indice 1. Esecuzione...

cve-2017-12149-playground

अनेक महत्वपूर्ण उद्योग बैंकिंग, स्वास्थ्य सेवा, और विनिर्माण लीगेसी मिडलवेयर पर निर्भर करते हैं जो विशेष रूप से JBoss 5 या 6 पर चलाने के लिए बनाया गया था। चूँकि ये एप्लिकेशन अक्सर WildFly JBoss के उत्तराधिकारी के आधुनिक संस्करणों में माइग्रेट करने के लिए बहुत नाजुक होते हैं, संगठन उन्हें पैच करने...

CVE-2025-29927

Einführung Durch das Fälschen des x-middleware-subrequest-Anfrageheaders wird der Next.js-Middleware-Authentifizierungsmechanismus umgangen, was einen unbefugten Zugriff auf geschützte Routen ermöglicht. Umgebungseinrichtung Der Projektquellcode stammt von P神, Next.js-Version 15.2.2 Für Next.js...

CVE-2025-54123

CVE-2025-54123 - Hoverfly-Befehlsinjektion RCE PoC CVE-2025-54123 - Middleware-Befehlsinjektion in Hoverfly 📌 CVE-Details ID : CVE-2025-54123 Typ : Befehlsinjektion / Remote-Code-Ausführung RCE Anbieter : Hoverfly Auswirkungen : Erlaubt authentifizierten Angreifern, beliebige Systembefehle über d...

NextJS_CVE-2025-29927

Next.js Autorisierungs-Bypass Demo Diese Anwendung demonstriert die x-middleware-subrequest-Schwachstelle in Next.js 13.4.19, die das Umgehen des Middleware-Schutzes ermöglicht. Einrichtung 1. Abhängigkeiten installieren: root@kitploit: npm install 2. Den Entwicklungsserver starten: root@kitploit...

PoC-CVE-2025-29927

PoC-CVE-2025-29927 漏洞是什么？ 该 CVE 报告了标头 x-middleware-subrequest 中的一个缺陷，该标头负责处理 Next.js 中的内部请求，允许攻击者绕过 Next.js 15.0.0 中的授权中间件，从而访问受保护的路由，例如 实际示例 在一个 Web 应用中，存在 /dashboard 路由，只有登录用户才能访问，但是，如果我们使用标头 x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware 发起请求，则可以在无需身份验证的情况下访问该路...