147482 matches found
PT-2026-84537
Name of the Vulnerable Software and Affected Versions WWBN AVideo affected versions not specified Description A path traversal issue exists in the 'get api login code' API endpoint. Unauthenticated attackers can delete arbitrary .log files by providing directory traversal sequences in the code...
CVE-2026-82222
CVE-2026-82222 — GiveWP 작성자: Rx019 CVSS: 10.0 치명적 유형: 인증되지 않은 PHP 객체 주입 → 원격 코드 실행 플러그인: GiveWP give — 기부 플러그인 및 펀드레이징 플랫폼 영향 버전: 패치 버전: 4.16.8 설명 GiveWP는 기부자의 lastname을 검증 없이 PHP 세션에 저장합니다. givelast 필드 없이 기부가 제출되면, GiveWP는 데이터베이스의 원시 값을 세션에 직접 역직렬화합니다. 이를 통해 인증되지 않은 공격자가 기부자 프로필 엔드포인트를 통해...
cve-2025-20333
CVE-2025-20333 - 종합 연구 및 익스플로잇 툴킷 개요 이 디렉토리에는 CVE-2025-20333 에 대한 종합적인 연구, 분석 및 개념 증명 코드가 포함되어 있습니다. 이는 Cisco ASA/FTD WebVPN 서버의 치명적인 스택 버퍼 오버플로 취약점입니다. 상태: ⚠️ 실제 환경에서 적극적으로 악용됨 ArcaneDoor 캠페인 CVSS 점수: 9.8 치명적 인증: 불필요 CVE-2025-20362를 통해 우회 영향: 루트 권한으로 원격 코드 실행 목차 📚 문서...
CVE-2025-59528
CVE-2025-59528: Flowise CustomMCP Удаленное выполнение кода PoC Go proof of concept для CVE-2025-59528 , нацеленный на версии Flowise...
CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
DEBIAN-CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-77348
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...
UBUNTU-CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication
CVE-2026-22017 – 인증 없는 BLE를 통한 펌웨어 업데이트 프로그램 코드 Python bleak peripheral root@kitploit: blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself: self.firmwaredata = bytearray...
CVE-2024-5084-Red-Team
🚀 HashForm Exploit – Lab Demo 이 저장소는 Hash Form WordPress 플러그인에서 발견된 취약점인 CVE-2024-5084에 대한 개념 증명 익스플로잇을 포함하고 있습니다. 오직 학습, 실험실 테스트 및 보안 연구 목적으로만 사용됩니다. 📌 취약점 정보 CVE ID: CVE-2024-5084 문제: 인증되지 않은 파일 업로드 → 원격 코드 실행 플러그인: Hash Form – Drag & Drop Form Builder ≤ 1.1.0 영향: 공격자가 악성 파일을 업로드하고 시스템 명령을 실행할 ...
EUVD-2026-66221
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...
CVE-2026-82852
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
CVE-2026-82228
Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...