css-the-bomb-inside-your-inbox

CSS: 受信トレイの中の爆弾 このリポジトリへようこそ。このリポジトリには、私の講演「CSS: 受信トレイの中の爆弾」に関するすべての資料が含まれています。 このリポジトリには、正当なセキュリティ研究、分析、および防御テストのみを目的として特定、開発、または収集された、概念実証コード、テストケース、および補足資料が含まれています。 この研究については、以下で読むことができます: 研究論文 目次 PoC CSS ホットワイヤリング ペーストによるトークン窃取 CSP が外部リソースをブロックする際のテキストノード窃取 HTML のみのキーロガー メール経由のプロンプトインジェクション...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 자동 익스플로잇 - 사용 가이드 이 스크립트가 하는 일 4개의 HTTP 요청 그룹으로 전체 계정 탈취 체인을 자동화합니다: 1. 취약점 확인 - 대상이 취약한지 확인 2. 이메일 열거 - 부울 오라클을 통해 관리자 이메일 추출약 500개 요청 3. 비밀번호 재설정 트리거 - Strapi의 비밀번호 복구 흐름 시작 4. 토큰 유출 - 40자 재설정 토큰 탈취약 320개 요청 5. 계정 탈취 - 탈취한 토큰을 사용하여 슈퍼 관리자 JWT 획득 기본 사용법 확인 전용 모드 안전 익스플로잇 없이 대상이...

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 설명 CVE-2026-25253 : OpenClaw 인증 토큰 유출 취약점 설명: OpenClaw일명 clawdbot 또는 Moltbot v2026.1.29 이전 버전에서 공격자가 조작된 gatewayUrl 쿼리...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

PT-2026-106058

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...

CVE-2026-104979: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

claude-code-security-audit

Claude Code Security Audit & CVE-2026-21852 Scanner A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 pre-trust execution surfaces, hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration...

CVE-2026-25253

CVE-2026-25253 OpenClaw ワンクリックRCE ★ CVE-2026-25253 OpenClaw ワンクリックリモートコード実行 PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 概要 CVE-2026-25253 : OpenClaw 認証トークン窃取の脆弱性 説明: OpenClaw（別名 clawdbot または Moltbot）は v2026.1.29 より前のバージョンにおいて、細工された gatewayUrl クエリ文字列値を...

PT-2026-106089

🚨 CVE-2026-97062 Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi 토큰 유출 및 비밀번호 재설정 Rocket.Chat및 Meteor 기반 애플리케이션을 위한 자동화된 익스플로잇 스크립트로, $where 절을 이용한 NoSQL 인젝션 을 통해 서버 측 예외를 발생시켜 비밀번호 재설정 토큰을 유출합니다. 토큰이 유출되면 스크립트는 인증되지 않은 비밀번호 재설정을 수행합니다. 취약점 개요 1. 인증 : 스크립트는 일반 사용자로 인증하여 /api/v1/users.list 엔드포인트에 접근합니다. 2. NoSQL 인젝션 : query 파라미터를 사용하여 $where...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A vulnerability exists in the StreamsHub Console for Apache Kafka where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys. This flaw allows a Console CR author to set config....

CVE-2026-96740: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...