Arjun

Arjun HTTPパラメータ発見スイート Arjunとは？ ArjunはURLエンドポイントのクエリパラメータを発見できます。意味がわからなくても大丈夫です。読み進めてください。 Webアプリケーションはユーザー入力を受け付けるためにパラメータ（またはクエリ）を使用します。次の例を考えてみてください。 http://api.example.com/v1/userinfo?id=751634589...

CVE-2022-28346

CVE-2022-28346 PoC 影响： QuerySet.annotate、aggregate和extra中可能存在SQL注入漏洞。 安装 root@kitploit: poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC root@kitploit: ?field=poc.title" FROM "pocblog" union SELECT...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - 通过 GitHub 认证中的 CSRF 实现账户接管（PoC） CVE-2022-24342 使用要求 使用方法 工作原理 GitHub OAuth2：查询参数处理顺序 CVE-2022-24342：HTTP 请求流程 使用要求 JetBrains TeamCity 如果在本地机器上运行该漏洞利用工具，你可能需要使用 Ngrok 或替代方案。 root@kitploit: $ ngrok http 8000 2. 创建 GitHub OAuth2 应用： root@kitploit: homepage:...

CVE-2025-49132

影響 /locales/locale.json を locale と namespace クエリパラメータとともに使用することで、認証なしで悪意のある攻撃者が任意のコードを実行できます。 任意のコードを実行できるため、この脆弱性は無数の方法で悪用される可能性があります。パネルのサーバーへのアクセス、パネルの設定 .env など からの認証情報の読み取り、データベースからの機密情報 ユーザー詳細 ユーザー名、メール、氏名、ハッシュ化されたパスワード、IP アドレスなど の抽出、パネルが管理するサーバーのファイルへのアクセスなどに使用される可能性があります。 使用方法...

CVE-2025-49132

影响 通过使用带有 locale 和 namespace 查询参数的 /locales/locale.json，恶意攻击者能够在无需身份验证的情况下执行任意代码。 由于能够执行任意代码，该漏洞可被以无数种方式利用。它可用于获取对面板服务器的访问权限、读取面板配置（.env 或其他）中的凭据、从数据库中提取敏感信息（例如用户详细信息用户名、电子邮件、名和姓、哈希密码、IP 地址等）、访问面板所管理服务器的文件等。 使用方法 root@kitploit: python exploit.py --target "pterodactyl.htb" --cmd 'curl...

Eclipse BIRT Viewer - Remote Code Execution

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters. id: CVE-2021-34427 info: name: Eclipse BIRT Viewer - Remote Code...

CVE-2019-7219

CVE-2019-7219 CVE-2019-7219 Zarafa Webapp 作者: verifysecurity 至少 Webapp 版本 1.6-46049 至 2.0.1.47791 受影响。 hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

CVE-2026-19651 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.12

Red Hat OpenShift Service Mesh 3.1.12 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

CVE-2026-74916

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

EUVD-2026-68990

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...

Astra Linux – Vulnerability in Firefox

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox versions earlier than 110...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...