CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Bypass de Autorização Resumo Executivo Este repositório contém um laboratório Docker local para reproduzir a CVE-2026-46645, uma vulnerabilidade de bypass de autorização que afeta o endpoint ajaxlookup do SQLAdmin. SQLAdmin é uma interface administrativa para...

BadHost-CVE-2026-48710-Exploit

BadHost – CVE-2026-48710 Scanner Nur-Erkennungs-Scanner für den BadHost -Authentifizierungsumgehungsangriff in Starlette / FastAPI – bei dem die Auth-Middleware request.url.path anstelle von request.scope"path" liest, sodass ein präparierter Host-Header einen erlaubten Pfad einschleusen und die...

GHSA-6JV3-5F52-599M python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Summary QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes...

CVE-2025-0182

A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending...