CVE-2026-55255-Lab

CVE-2026-55255 - Langflow의 /api/v1/responses IDOR 취약점 핵심 요약 이 저장소는 Langflow의 OpenAI 호환 Responses API에 영향을 미치는 안전하지 않은 직접 객체 참조IDOR 취약점인 CVE-2026-55255를 재현하고 검증하기 위한 로컬 Docker 랩을 포함합니다. Langflow는 AI 기반 에이전트와 워크플로우를 구축하고 배포하기 위한 오픈소스 플랫폼입니다. 취약한 동작은 /api/v1/responses 엔드포인트에 영향을 미치며, 인증된 공격자가 다른 사용자...

CVE-2019-16113-Dockerfile

Bludit 디렉터리 트래버설 취약점（CVE-2019--16113） Bludit-3.9.2는 LAMP 환경만 있으면 실행할 수 있는 경량 CMS입니다. 이미지 업로드 시 Bludit은 파일 확장자를 확인한 후 파일을 제때 삭제하지 않으므로, 공격자는 uuid 매개변수를 제어하여 디렉터리 트래버설을 수행할 수도 있습니다. 구체적인 내용은 참고 취약점 환경 다음 명령을 실행하여 이미지를 빌드하고 Bludit 컨테이너를 시작합니다 cd Docker sudo docker build -t bludit:cve . 编译镜像 sudo...

PYSEC-2026-2127

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting XSS vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The taguuid path parameter is reflected directly in the HTTP response body...

CVE-2026-29038

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting XSS vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The taguuid path parameter is reflected directly in the HTTP response body...

changedetection.io 安全漏洞

changedetection.io is a website monitoring and notification application developed by dgtlmoon. Versions of changedetection.io prior to 0.54.1 contained a security vulnerability. This vulnerability stemmed from the RSS monitoring endpoint not properly escaping the UUID path parameter in HTML, whic...

CVE-2019-25399

IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...

CVE-2019-25399

IPFire 2.21 Core Update 127 contains multiple stored XSS vulnerabilities in the extrahd.cgi script. Attackers can submit POST requests with script payloads in the FS, PATH, and UUID parameters, enabling execution of arbitrary JavaScript in the context of authenticated administrator sessions. The ...

PT-2026-20501

IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute...

PT-2025-52829

Name of the Vulnerable Software and Affected Versions Orangescrum version 1.8.0 Description Orangescrum version 1.8.0 has an authenticated SQL injection issue. Authorized users can manipulate database queries through vulnerable parameters. Specifically, attackers can inject malicious SQL code int...

CVE-2025-12919

Summary: CVE-2025-12919 affects EverShop up to 2.0.1, specifically the function in /src/modules/oms/graphql/types/Order/Order.resolvers.js within the Order Handler. The vulnerability stems from manipulation of the uuid argument, causing improper control of resource identifiers and enabling a remo...

CVE-2025-10496

The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-10496 Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting

The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-10496

CVE-2025-10496 affects the WordPress plugin Cookie Notice & Consent (versions up to 1.6.5). Root cause: stored cross-site scripting via the uuid parameter due to insufficient input sanitization/output escaping. Impact: unauthenticated attackers can inject arbitrary scripts that execute when users...

CVE-2025-10496: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2021-26931

Malware in sbrugna...

CVE-2025-5107

A vulnerability was found in Fujian Kelixun 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /app/xmlcdr/xmlcdrdetails.php. The manipulation of the argument uuid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed ...

CVE-2021-32092

A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...

DiDi Super-Jacoco 命令注入漏洞

DiDi Super-Jacoco is a one-stop JAVA code full/diff coverage collection platform from China's DiDi DiDi company. A command injection vulnerability exists in DiDi Super-Jacoco version 1.0, which stems from the parameter uuid in the file /cov/triggerEnvCov that can lead to command injection...

CVE-2024-2621

A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwdupdate.php. The manipulation of the argument uuid leads to sql injection. The atta...

Fujian Kelixin Command and Dispatch Platform SQL Injection Vulnerability

Fujian Kelixin Command and Dispatch Platform is a command and dispatch platform from Fujian Kelixin Company. A SQL injection vulnerability exists in Fujian Kelixin Command and Dispatch Platform version 20240318 and earlier versions, which originates from an unknown function in...