CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - 인증되지 않은 저장형 크로스 사이트 스크립팅 플러그인 URL https://wordpress.org/plugins/wp-stats/ 설명 statspage의 statsauthor GET 파라미터에서 발생하는 인증되지 않은 반사형 XSS입니다. 정제 필터 striptags가 urldecode 이전에 적용되어, 공격자가 페이로드를 이중 URL 인코딩하여 이를 우회할 수 있습니다. POC 1. WP-Stats 플러그인을 설치하고 활성화합니다 2. pagestats 숏코드가...

SSRF-CVE-2020-15002

요약 /appsuite/api/oxodocumentfilter&action=addfile 처리 시 적용되는 URL 검증 로직에는 Time of Check Time of UseToCToU SSRF 공격을 실행하는 데 사용될 수 있는 세 가지 결함이 있습니다. 이 문제는 악의적인 행위자가 내부 네트워크 서비스에 HTTP GET 요청을 실행할 수 있게 하며, 보호된 정보 유출로 이어질 수 있습니다. 결함 1: Time of Check Time of Use ToCToU 취약점 URITools.getFinalURL 메서드 여기에 구현된...

CVE-2026-48710

CVE-2026-48710 原理： Starletteはオープンソースの軽量なPython ASGIフレームワークです。 StarletteフレームワークがURLデータ構造の処理においてクライアントが送信したhostを信頼し、そのままurl変数に連結して後続の認証処理を行うことに起因します。 元のURLは uvicorn\protocols\http\httptoolsimpl.py で処理されます def onmessagebeginself - None: self.url = b"" self.expect100continue = False self.headers =...

cve-2026-43515-poc

CVE-2026-43515 — Обход ограничения безопасности Apache Tomcat Вердикт об эксплуатируемости: подтверждено, что уязвимость эксплуатируема. POST-запрос к ресурсу, защищенному разделенной конфигурацией , полностью обходит аутентификацию. Требуемая форма web.xml необычна для стандартных развертываний ...

CVE-2022-41040

CVE-2022-41040 서버 측 요청 위조에 취약한 Microsoft Exchange Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 Xiaomi의 심각한 취약점에 대한 기술 보고서 취약점 요약 다양한 MIUI 기기의 Xiaomi 기본 브라우저com.android.browser에서 취약점이 발견되었습니다. 이 앱은 startActivity를 통해 전달된 인텐트를 제대로 검증하지 못하여, 악성 앱이 임의의 URL을 열거나 의도하지 않은 작업을 수행할 수 있습니다. CVE ID : CVE-2024-45352 구성 요소 :com.android.browser 심각도 : Medium 상태 : Xiaomi에 보고됨 확인 대기 중 ...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core

Summary IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations...

CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006

Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to a security bypass where attacker-controlled HTML in inbound emails or tickets can circumvent the image URL sanitizer . By using path traversal sequences , an attacker can cause the browser to resolve a URL to a protected API end...

EUVD-2026-87270

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-56734

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-63206

The Zammad open source helpdesk system is vulnerable to a remote image tracking bypass in versions prior to 7.1.2 . The root cause is a flaw in the HTML sanitizer , which fails to recognize shortened URL formats that omit the double slash after the scheme (e.g., http:) as remote content. While th...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab Home Assistant Companion for Androidの公開脆弱性レポートGHSL-2023-142と脆弱バージョン 2023.8.2 のオープンソース構造に基づいて作成した、教育用の縮小再現Labです。 実際のHome Assistantサーバー・アカウント・トークンは使用しません。LABTOKENCVE202341898NOTREAL という固定の仮想トークンのみを公開します。 脆弱性の概要 対象: Home Assistant Companion for Android 影響バージョ...

CVE-2026-97871

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...