rbac

PHP-RBAC v2.x PHP-RBACは、PHP用の認可ライブラリです。開発者にNISTレベル2の階層型ロールベースアクセス制御などを、これまでで最速の実装で提供します。 現在の安定版リリース: PHP-RBAC v2.0 私たちとつながる ホームページ: http://phprbac.net/ OWASPプロジェクトページ: https://www.owasp.org/index.php/Phprbac PHP-RBACドキュメント: http://phprbac.net/docscontents.php PHP-RBAC Wiki:...

telegram-osint-lib

Telegram OSINT 시나리오 라이브러리 설명 많은 Telegram API 라이브러리들이 있지만, 채널에서 모든 사진을 가져오거나, 사용자 존재를 모니터링하거나, 새 계정을 등록하는 것과 같은 복잡한 시나리오를 실행하는 방법을 보여주는 라이브러리는 없습니다. 이 프로젝트는 이 상황을 개선하는 것을 목표로 합니다: 이제 새로운 시나리오를 쉽게 만들고 기존 시나리오를 원클릭으로 실행할 수 있습니다. 공식 Android 클라이언트의 Telegram API를 사용합니다. 근거 Telegram 프로토콜...

php-encryption

php-encryption root@kitploit: composer require defuse/php-encryption 这是一个用于在 PHP 中使用密钥或密码加密数据的库。它要求 PHP 5.6 或更高版本，以及 OpenSSL 1.0.1 或更高版本。 我们建议使用 仍受安全支持 的 PHP 版本，在撰写本文时即 PHP 8.0 或更高版本。在不受支持的 PHP 版本上使用此库可能会导致安全漏洞。 php-encryption 的当前版本是 v2.4.0。该库预计将保持稳定，并由其作者持续提供安全和错误修复支持，直到至少 2024 年 1 月 1 日。 该库是...

PHP-Fuzzer

PHP 퍼저 이 라이브러리는 PHP용 퍼저를 구현하며, 라이브러리특히 파싱 라이브러리에 '무작위' 입력을 제공하여 버그를 찾는 데 사용할 수 있습니다. 엣지 커버리지 계측의 피드백을 사용하여 새로운 코드 경로가 방문되도록 '무작위' 입력의 선택을 안내합니다. 설치 Phar 권장 : 이 라이브러리의 phar 패키지를 릴리스 페이지에서 다운로드할 수 있습니다. phar를 사용하는 것이 권장되는 이유는 PHP-Parser를 사용하는 라이브러리와의 의존성 충돌을 피할 수 있기 때문입니다. Composer : composer globa...

limitrr-php

Redis を使用した PHP 内での軽量なレート制限。 Limitrr PHP は、私が NodeJS 用に作成した別のライブラリである Limitrr から非常に大きな影響を受けています。そちらはこちらで確認できます。 Limitrr PHP を使用すると、アプリケーションにレート制限を簡単に統合できます。他の類似パッケージとは異なり、このユーティリティはリクエスト数だけでなく完了したアクション数（例：一定期間内に正常に作成できるアカウント数）でも制限でき、しかもカスタムオプションで制限を設定できます。さらに、カスタムディスクリミネーターも使用できるため、ユーザーの IP...

CVE-2022-41343

CVE-2022-41343 🐍 CVE-2022-41343 の Python Exploit dompdf 2.0.1 用 Staged Reverse Shell 基づく: Positive Sec's write-up および PoC 例 root@kitploit: cve-2022-41343 10.10.16.3 44444 使い方 root@kitploit: usage: cve-2022-41343 -h -l SERVERPORT -s SHELL -n FONTNAME ip port positional arguments: ip Shell Callback...

zappzarapp-php-security

⚡ zappzarapp/security CSP、セキュリティヘッダー、CSRF保護、セキュアクッキー、パスワード検証、入力サニタイズ、レート制限、SRI、シークレット読み込み、暗号化、セッションセキュリティ、TOTP二要素認証、署名付きURL、セキュリティイベントログを提供する包括的なPHPセキュリティライブラリです。 主な特長 オールインワン — 単一の構成可能なパッケージに17のセキュリティモジュール デフォルトでセキュア — 厳格なCSP、unsafe-なし、HTTPS優先 フレームワーク非依存 — 任意のPHP 8.4+アプリケーションで動作 イミュータブル＆型安全 —...

zend-crypt

zend-crypt リポジトリは2019-12-31に放棄されました このリポジトリは laminas/laminas-crypt に移動しました。 Zend\Crypt は、いくつかの暗号化ツールのサポートを提供します。 利用可能な機能の一部は次のとおりです。 対称暗号を使用したencrypt-then-authenticate（認証ステップは HMACによって提供されます）; 対称鍵および公開鍵アルゴリズムを使用した暗号化/復号化（例: RSAアルゴリズム）; ハイブリッドモード（OpenPGPライク）を使用した暗号化/復号化; 公開鍵アルゴリズムを使用したデジタル署名の生成（例:...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

EUVD-2026-78905

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API . In versions prior to 3.0.0 , Request::buildRequestUrl() joins path variable values without URL-encoding each segment. An attacker who controls a path variable value (e.g., scheme or contentId) through a consuming applicatio...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55375

canto-saas-api (PHP library for the Canto SaaS API) prior to 3.0.0 sends OAuth credentials (app_id, app_secret, refresh_token, code) in the URL query string of token POST requests rather than the request body. Because request URLs are commonly recorded in access logs, proxy logs, and APM traces, ...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

EUVD-2026-78902

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88023

CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...