CVE-2026-69328

StorSvc는 SYSTEM 권한으로 SprintCSP.dll을 상대 이름으로 로드합니다. 사용자가 쓸 수 있는 HKLM PATH 디렉터리에 이 DLL을 심으면 SYSTEM 권한을 얻습니다. HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path에 사용자가 쓸 수 있는 디렉터리가 필요합니다. 깨끗한 이미지에는 없습니다. 툴링 설치 프로그램이 추가합니다 %USERPROFILE%.cargo\bin, .local\bin, Python Scripts. 해당...

CVE-2021-43798

usage: grafana-exploit.py -h -H/--host HOST grafana-exploit.py: error: the following arguments are required: -H/--host 示例：python3 grafana-exploit.py --host 如果成功读取任意文件，将显示请求 URL 和 curl 命令 +RequestURL http://example.host/public/plugins/loki/../../../../../../../../../../../../../etc/passwd...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: 페이지 템플릿 해석에서의 비인증 경로 순회 WordPress Core에서 이중 인코딩된 pagename 값을 통한 비인증 로컬 PHP 파일 포함 — 그리고 특정 배포 조건에서는 웹 서버 계정의 권한으로 PHP 코드 실행. | ---|--- CVE| CVE-2026-87902 벤더 권고| GHSA-7hp8-65ch-5whp 분석 글| CVE-2026-87902: Critical WordPress file inclusion and conditional RCE 영향 범위|...

CVE-2026-106186

An uncontrolled search path element flaw was found in the CredentialProvider component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522557469...

CodePath_Week_7-8

CodePath 7-8주차 CodePath 7주차 및 8주차 과제: CVE-2017-14719, CVE-2019-9787 및 REST API를 통한 인증되지 않은 페이지/게시물 콘텐츠 수정 프로젝트 7 - WordPress 펜테스팅 총 소요 시간: 16 시간 목표: 오래된 버전의 WordPress에 영향을 미치는 취약점을 찾고, 분석하고, 재현하고, 문서화한다 펜테스팅 보고서 1. CVE-2017-14719 요약: 파일 압축 해제 코드에서 경로 탐색Path Traversal 취약점이 발견되었습니다. 취약점 유형: 경로...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106491

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106486

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

An improper authorization check in the Gitea push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When the [security] IMPORT_LOCAL_PATHS = true setting is enabled, an administrator who lacks permission to import local paths can configur...

EUVD-2026-94051

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106491 Backstage: Improper input validation in proxy-backend

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106491

The Backstage framework, an open framework for building developer portals, is vulnerable to improper input validation within the @backstage/plugin-proxy-backend package in versions prior to 0.6.17 . An authenticated user can craft a request URL that forces the proxy-backend to forward requests to...

CVE-2026-106491

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106491 Backstage: Improper input validation in proxy-backend

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-79809

An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role...