CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - 通过 GitHub 认证中的 CSRF 实现账户接管（PoC） CVE-2022-24342 使用要求 使用方法 工作原理 GitHub OAuth2：查询参数处理顺序 CVE-2022-24342：HTTP 请求流程 使用要求 JetBrains TeamCity 如果在本地机器上运行该漏洞利用工具，你可能需要使用 Ngrok 或替代方案。 $ ngrok http 8000 2. 创建 GitHub OAuth2 应用： homepage: "http://exploit-host:8000"...

Eclipse BIRT Viewer - Remote Code Execution

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters. id: CVE-2021-34427 info: name: Eclipse BIRT Viewer - Remote Code...

CVE-2022-28346

CVE-2022-28346 PoC 影响： QuerySet.annotate、aggregate和extra中可能存在SQL注入漏洞。 安装 poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT "-1,",sqliteversion,"3" -- 参考文献 CVE Mit...

Arjun

Arjun HTTPパラメータ発見スイート Arjunとは？ ArjunはURLエンドポイントのクエリパラメータを発見できます。意味がわからなくても大丈夫です。読み進めてください。 Webアプリケーションはユーザー入力を受け付けるためにパラメータ（またはクエリ）を使用します。次の例を考えてみてください。 http://api.example.com/v1/userinfo?id=751634589...

CVE-2026-103261

A flaw was found in Tornado. When processing incoming HTTP requests, Tornado fails to restrict the number of parameters parsed from the URL query string. A remote, unauthenticated attacker could exploit this flaw by sending requests with an excessive number of query parameters, leading to high CP...

AlmaLinux 9.6 [TuxCare] Security Update: go-filesystem / go-rpm-macros / go-rpm-templates / go-srpm-macros (ALMALINUX9.6:CLSA-2026:1773161647)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773161647 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs i...

Rocky Linux 9.6 [TuxCare] Security Update: go-filesystem / go-rpm-macros / go-rpm-templates / go-srpm-macros (ALMALINUX9.6:CLSA-2026:1773161647)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773161647 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs...

CLEANSTART-2026-PN80306 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the coredns package. The net/url package does not set a limit on the number of query parameters in a query...

CVE-2025-49132

影響 /locales/locale.json を locale と namespace クエリパラメータとともに使用することで、認証なしで悪意のある攻撃者が任意のコードを実行できます。 任意のコードを実行できるため、この脆弱性は無数の方法で悪用される可能性があります。パネルのサーバーへのアクセス、パネルの設定 .env など からの認証情報の読み取り、データベースからの機密情報 ユーザー詳細 ユーザー名、メール、氏名、ハッシュ化されたパスワード、IP アドレスなど の抽出、パネルが管理するサーバーのファイルへのアクセスなどに使用される可能性があります。 使用方法 python poc....

CVE-2025-49132

影响 通过使用带有 locale 和 namespace 查询参数的 /locales/locale.json，恶意攻击者能够在无需身份验证的情况下执行任意代码。 由于能够执行任意代码，该漏洞可被以无数种方式利用。它可用于获取对面板服务器的访问权限、读取面板配置（.env 或其他）中的凭据、从数据库中提取敏感信息（例如用户详细信息用户名、电子邮件、名和姓、哈希密码、IP 地址等）、访问面板所管理服务器的文件等。 使用方法 python exploit.py --target "pterodactyl.htb" --cmd 'curl...

CVE-2019-7219

CVE-2019-7219 Zarafa Webapp 著者: verifysecurity 少なくともWebapp バージョン1.6-46049から2.0.1.47791までが影響を受けます。 hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-61685

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...

CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters

ClipBucket v5 before 5.5.3-182 contains a reflected cross-site scripting vulnerability in the sortlink helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary...

CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters

ClipBucket v5 before 5.5.3-182 contains a reflected cross-site scripting vulnerability in the sortlink helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary...

CVE-2026-95812

ClipBucket v5 before version 5.5.3-#182 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue resides in the sort_link() helper function, which fails to properly sanitize the cat , sort , and time query parameters. An attacker can craft a malicious request containing an...

EUVD-2026-83587

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...

CVE-2026-79713

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

EUVD-2026-82684

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-82191

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...