CVE-2025-7783-poc

form-data boundary randomness vulnerability CVE-2025-7783 主に https://hackerone.com/reports/2913312 を基にしています。著者は https://hackerone.com/parrot409?type=user です。 インストール: npm install python3 がインストールされ、z3 モジュールが利用可能であることを確認してください（pip3 install -r requirements.txt）-- エクスプロイトコードは python3...

gattacker

BLE（Bluetooth Low Energy）Man-in-the-Middle などのためのNode.jsパッケージ。 前提条件 参照： https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno インストール npm install gattacker 使い方 設定 両方のコンポーネントを実行する場合、config.envで変数を設定します： NOBLEHCIDEVICEID : noble（"central", ws-slave）デバイス BLENOHCIDEVICEID :...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 説明: リモートの認証済みユーザーが、ソフトウェアストアの設定メニューを介して任意のコマンドを実行できます。 影響を受けるバージョン: すべて = 6.6.6 情報 このPoCを作成するために、docker-composeを使用してソフトウェアをインストールしました。 脆弱性タイプ: リモートコマンド実行 認証済みRCE POC...

CVE-2026-37432

CVE-2026-37432 場所: Apiutil.java: 107-113 原則: X-Forwarded-For リクエストヘッダーを直接信頼しているため、偽装されてIPアドレスを操作される可能性があります。 悪用方法: X-Forwarded-For: 127.0.0.1...

CVE-2025-63700

CVE-2025-63700 Clerk-js 5.88.0 における OAuth 認証バイパス 影響を受ける製品 ベンダー : Clerk Inc. clerk.dev / clerk.com 製品 : Clerk-js @clerk/clerk-js 影響を受けるバージョン : 5.88.0 影響 : OAuth 認証バイパス CWE-290 : スプーフィングによる認証バイパス 脆弱性発見者 Hasnat Ibrahim Nishat - LinkedIn Md Foysal Hossain - LinkedIn Md Asadujjaman Noor - LinkedIn 説明...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785509707)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785509707 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785509707)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785509707 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

Exposure of Resource to Wrong Sphere

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the globalAgent process. An attacker can access sensitive HTTPS credentials and intercept or manipulate...

ROS-20260914-73-0068

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

EUVD-2026-72665

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

CVE-2026-67316

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

CVE-2026-11462

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper...

PT-2026-47190

Name of the Vulnerable Software and Affected Versions BeikeShop versions prior to 1.6.0.22 Description Improper authorization exists in the Stripe Plugin component. A remote attacker can manipulate the Request argument within the callback function of the file...

Iris 安全漏洞

Iris is an open-source fast, simple, yet fully functional and highly efficient Go network framework developed by DFIR-IRIS. Versions of Iris prior to 2.4.28 contained security vulnerabilities, which stemmed from allowing users to manipulate API requests to modify values in the database...

CVE-2018-25358 D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the tablename parameter in POST requests. Attackers can send requests to /mycgi.cgi with tablename values like adminuser,...

CVE-2018-25358

The CVE-2018-25358 entry concerns the D-Link DIR-601 (firmware 2.02NA) where an unauthenticated attacker can disclose credentials via /my_cgi.cgi by manipulating the table_name parameter in POST requests. Affected data includes administrative credentials and wireless keys, exposed in cleartext. T...