CVE-2025-49132

CVE-2025-49132 概念実証（PoC） このリポジトリには、Pterodactyl Panel バージョン1.11.11以前における重大な認証なしリモートコード実行（RCE）脆弱性 CVE-2025-49132 の概念実証（PoC）が含まれています。 脆弱性の詳細 CVE ID : CVE-2025-49132 重要度 : 10.0 重大 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 影響を受けるバージョン : --os --traversal-level コマンド例 python CVE-2025-49132-PoC.py te...

BIT-ENVOY-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Hikvision IP カメラ / DVR / NVR 不適切な認証 — 細工されたクエリパラメータによる権限昇格 | ---|--- CVE ID| CVE-2017-7921 脆弱性クラス| CWE-287: 不適切な認証 CVSS v3.0 基本値| 10.0 致命的 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v2.0 スコア| 7.5 高 — AV:N/AC:L/Au:N/C:P/I:P/A:P 開示日| 2017 年 ICS-CERT アドバイザリ ICSA-17-124-01 ベンダー|...

PT-2026-102725

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext authz filter assumes that a request contains a :path pseudoheader when applying query parameters to set or query parameters to remove from an...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 は SQL インジェクションを許容します 推奨説明 : 「ISIDA RETRIEVER v5.2」SQLインジェクション 脆弱な機能 : ISIDA RETRIEVER Platform は SQL インジェクションに対して脆弱です 脆弱なURLとパラメータ : website.com/index.php?title=Injection 脆弱なURLとパラメータ : website.com/index.php?title=info?mode=info?query=Injection 脆弱なパラメータ :...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase 未認証のNoSQLオペレーターインジェクション Budibaseにおける未認証のJSON/NoSQLオペレーターインジェクション。ドキュメントデータソース（MongoDB、CouchDB、Elasticsearch、DynamoDB-PartiQL、またはJSONボディを持つREST）をバックエンドとするPUBLIC クエリを公開しているBudibaseアプリにアクセスする匿名の訪問者は、単一の未認証HTTPリクエストで、バックエンドのコレクションのすべてのドキュメントを読み取り...

CVE-2026-100753

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

GO-2026-6518 Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses

Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses...

CVE-2021-40438

CVE-2021-40438 エクスプロイト PoC（Docker セットアップ付き） Apache 設定と Dockerfile（リポジトリ内に同梱）が含まれるディレクトリに移動します。 イメージのビルド: docker build -t cve-2021-40438:1.0 . Docker イメージの実行: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 （注: イメージ名の代わりにイメージ ID を使用することもできます。イメージの詳細は 'docker images' コマンドで確認してください） エクスプロイトの実行: cur...

CVE-2026-100753: Improper Neutralization of Input During Web Page Generation

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment...

CVE-2026-100391

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

EUVD-2026-87328

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391

MediaFlow Proxy versions through 2.4.9 are vulnerable to a server-side request forgery (SSRF) in the /proxy routes. The root cause is missing and incomplete destination validation in the d query parameter. This allows remote attackers to supply arbitrary internal URLs, including loopback addresse...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391: Server-Side Request Forgery (SSRF)

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

PT-2026-97922

Name of the Vulnerable Software and Affected Versions Termix versions 2.5.0 through 2.5.0 Description The '/homepage/proxy' endpoint accepts a url query parameter from an authenticated user and passes it to http.get or https.get without destination restrictions. In the file...