gattacker

一个用于 BLE（蓝牙低功耗）中间人攻击及更多功能的 Node.js 包。 前置条件 参见： https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno 安装 root@kitploit: npm install gattacker 用法 配置 运行两个组件，在 config.env 中设置变量： NOBLEHCIDEVICEID : noble（"中央设备"，ws-slave 从机）设备 BLENOHCIDEVICEID : bleno（"外围设备"，广播）设备 如果你在仅有一个 BT4...

CVE-2026-37432

CVE-2026-37432 Posizione: Apiutil.java: 107-113 Principio: fidarsi direttamente dell'header di richiesta X-Forwarded-For, che può essere falsificato per manipolare gli indirizzi IP. Metodo di sfruttamento: X-Forwarded-For: 127.0.0.1...

CVE-2025-7783-poc

Schwachstelle bei der Zufälligkeit der form-data-Grenze CVE-2025-7783 Weitgehend basierend auf https://hackerone.com/reports/2913312 von https://hackerone.com/parrot409?type=user Installation: npm install Stellen Sie sicher, dass python3 mit dem z3-Modul installiert ist pip3 install -r...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 Descrição : permite que usuários remotos autenticados executem comandos arbitrários por meio do menu de configurações do Software Store. Versão afetada : Todas = 6.6.6 Informações Para fazer este PoC, apenas instalei o software usando docker-compose Tipo de...

CVE-2025-63700

CVE-2025-63700 Clerk-js 5.88.0 में OAuth प्रमाणीकरण बाइपास प्रभावित उत्पाद विक्रेता : Clerk Inc. clerk.dev / clerk.com उत्पाद : Clerk-js @clerk/clerk-js प्रभावित संस्करण : 5.88.0 प्रभाव : OAuth प्रमाणीकरण बाइपास CWE-290 : स्पूफिंग द्वारा प्रमाणीकरण बाइपास बग लेखक Hasnat Ibrahim Nishat - LinkedIn ...

CVE-2026-67316

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

CVE-2026-11462

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper...

PT-2026-47190

Name of the Vulnerable Software and Affected Versions BeikeShop versions prior to 1.6.0.22 Description Improper authorization exists in the Stripe Plugin component. A remote attacker can manipulate the Request argument within the callback function of the file...

Iris 安全漏洞

Iris is an open-source fast, simple, yet fully functional and highly efficient Go network framework developed by DFIR-IRIS. Versions of Iris prior to 2.4.28 contained security vulnerabilities, which stemmed from allowing users to manipulate API requests to modify values in the database...

CVE-2018-25358 D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the tablename parameter in POST requests. Attackers can send requests to /mycgi.cgi with tablename values like adminuser,...

CVE-2018-25358

The CVE-2018-25358 entry concerns the D-Link DIR-601 (firmware 2.02NA) where an unauthenticated attacker can disclose credentials via /my_cgi.cgi by manipulating the table_name parameter in POST requests. Affected data includes administrative credentials and wireless keys, exposed in cleartext. T...

EUVD-2021-34834

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted filename and foldername parameters to delete...

CVE-2026-7416

Summary: CVE-2026-7416 affects PolarVista xcode-mcp-server 1.0.0, specifically the MCP Interface’s build_project/run_tests in src/index.ts. The vulnerability arises from manipulating the Request argument, enabling an OS command injection. The advisory notes remote feasibility and public disclosur...

CVE-2026-7234 BrowserOperator browser-operator-core server.js startsWith path traversal

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/componentserver/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploit...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution through the mergeConfig code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config obje...

CVE-2025-65133

A SQL injection vulnerability exists in the School Management System version 1.0 by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information...

GHSA-2VRM-GR82-F7M5 AIOHTTP has CRLF injection through multipart part content type header construction

Summary An attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits. Impact If an application allows untrusted data to be used for the multipart contenttype parameter when constructing a request, an attacker may be able to manipulate th...

SourceCodester Pharmacy Product Management System 安全漏洞

SourceCodester Pharmacy Product Management System is an open-source drug management system developed by SourceCodester. Version 1.0 of the SourceCodester Pharmacy Product Management System contains a security vulnerability. This vulnerability arises from the fact that the add-sales.php file does...

ALPINE-CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngxmailsmtpmodule module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation...