Accept Donations with PayPal <= 1.5.2 - Open Redirect

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2021-31166

CVE-2021-31166 作った理由 私は最近、CVE-2021-31166 のエクスプロイトを作成しました。これは CVE-2021-31166 と CVE-2021-31166 を利用します。ペネトレーションテスターは https://github.com/mauricelambert/CVE-2021-31166 を使うべきですが、SOC チームは適切に修正するために特定の脆弱性を把握する必要があるため、このエクスプロイトを作成しました。 説明 脆弱な IIS Web サーバーを攻撃するための、純粋な Python、PowerShell、Ruby...

cve-2022-21907-http.sys

cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - http.sys 드라이버의 Double Free. 요약 인증되지 않은 공격자가 "Accept-Encoding" HTTP 요청 헤더가 포함된 HTTP 요청을 전송하여 HTTP 프로토콜 스택http.sys 내의 알 수 없는 코딩 목록unknown coding-list에서 double free를 유발하고 패킷을 처리하는 과정에서 커널 충돌을 일으킬 수 있습니다. 취약한 시스템 Windows Server 2019 및 Windows 10 버전...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

CVE-2019-5418

CVE-2019-5418 テストケース 実行 : $ rails s 概念実証 PoC : Accept: ../../../../../../../../etc/passwd リクエスト 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ CATCH...

CVE-2022-21907-http.sys

CVE-2022-21907 - http.sys ドライバーの二重解放 Double Free CVE-2022-21907 - http.sys ドライバーの二重解放 Double Free 概要 認証されていない攻撃者が、HTTP プロトコル スタック http.sys 内の unknown coding-list で二重解放を引き起こす「Accept-Encoding」HTTP リクエスト ヘッダーを含む HTTP リクエストを送信してパケットを処理させると、カーネル クラッシュが発生します。 脆弱なシステム Windows Server 2019 および Windows 10...

cve-2022-21907

CVE-2022-21907 - 1vere$k의 Golang 애플리케이션 CVE-2022-21907 - http.sys 드라이버의 이중 해제Double Free. 요약 이것은 여러 대상에 동시에 요청을 보낼 수 있는 멀티스레드 Golang 애플리케이션입니다. POST 요청에서 생산성이 높지는 않지만, 선형 방식에 비해 약 30%의 속도 향상을 제공합니다. 인증되지 않은 공격자는 "Accept-Encoding" HTTP 요청 헤더를 포함한 HTTP 요청을 보내 HTTP 프로토콜 스택http.sys 내 알 수 없는 코딩 목록에서 이...

CVE-2021-31166

CVE-2021-31166 CVE-2021-31166 HTTP 프로토콜 스택 취약점 악용 시도 탐지 Suricata 규칙 Zeek 패키지 참고 자료 https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166 https://github.com/0vercl0k/CVE-2021-31166...

cve-2017-8890-msf

모듈: Phoenix Talon CVE 2017-8890 이는 Phoenix Talon 모듈을 요청하는 이슈 8571를 해결할 수 있습니다. 2017-8890 개요 이 CVE: Linux 커널 취약점의 Phoenix Talon 계열 중 가장 심각한 것입니다. 이 CVE에 대한 POC는 Exploit DB에 존재하지 않습니다. 그러나 다른 공개 POC는 사용 가능합니다. 잘 문서화되어 있지 않습니다. 하지만 취약점에 대한 일반적인 이해를 돕기 위한 간단한 설명이 있습니다. 모든 커널 버전 4.10.15까지 존재하지만, 일부 소스...

CVE-2019-5418

CVE-2019-5418 - Rails におけるファイルコンテンツ開示 EDIT : このCVEはリモートコード実行（RCE）につながる可能性があります。詳細: https://github.com/mpgn/Rails-doubletap-RCE Action View には、ファイルコンテンツ開示の脆弱性が存在する可能性があります。 特別に細工された Accept ヘッダーと render file: の呼び出しを組み合わせることで、 対象サーバー上の任意のファイルがレンダリングされ、ファイルの内容が 開示される可能性があります。 影響は、accept...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

CVE-2020-27223

CVE-2020-27223 사용 방법 $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 수정됨 $...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

CVE-2019-5418

CVE-2019-5418 サンドボックス https://groups.google.com/forum/!msg/rubyonrails-security/zRNVOUhKHrg/GmmcVXcmAAAJ 初期化 $ git clone https://github.com/takeokunn/CVE-2019-5418 $ cd https://github.com/takeokunn/CVE-2019-5418 $ docker-compose up 使用方法 $ curl localhost/sandbox -H 'Accept: ../../config/database.y...

CLEANSTART-2024-IK84393 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

CentOS Linux 8.4 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790610331)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790610331 advisory. - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media type parser to take muc...

CVE-2026-96818

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

EUVD-2026-89871

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...