CVE-2023-22432

CVE-2023-22432 web2pyの脆弱性（CVE-2023-22432）のPoC検証 web2py の脆弱性（CVE-2023-22432）が2023年1月31日（米国時間）に公開されました。この記事では、この脆弱性に関する検討と検証結果について説明します。 脆弱性の概要 この脆弱性は、web2pyのオープンリダイレクト脆弱性であり、管理ページのURLにおいてコールバック先URLとして任意のURLを指定できます。もともとオープンリダイレクト対策は実装されていましたが、URLに特別なバイパス手法を適用することで再現されます。これにより、悪意のあるサイトに誘導される可能性があります...

vulnerability-in-Remix-React-Router-CVE-2025-31137-

概要 私は @zhero の個人ブログ記事の writeup を読んだ後、仕組みを学ぶためにこの CTF を作成することにしました。その後、この脆弱性の悪用を学びたい人なら誰でも共有できるようにすることにしました。[email protected] バージョンで CTF を作成しようとしましたが、@remix-run/express を確認したところ、コードが修正されていることに気付きました。そこで、脆弱性のあるコードを彼らの GitHub からコピー＆ペーストしました。以下の指示に従って、@remix-run/express パッケージのコードを変更する必要があります。 目標...

Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting. id: CVE-2022-0899 info: name: Header Footer Code Manager 1.1.24 - Cross-Site Scripting author:...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

PT-2026-107411

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

Next.js-Middleware-Bypass-CVE-2025-29927-

概要 @zhero の個人ブログ記事を読んだ後、どうやって動くのかを学ぶためにこのCTFを構築することにしました。その後、この脆弱性の悪用方法を学びたい人なら誰でも共有できるようにしました。zhero と inzo に多大な感謝を捧げます。彼らのブログ記事はこちらにあります: "https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" 目標 ミドルウェアをバイパスして管理ページのフラグを見つける必要があります。また、素晴らしいAssetnoteの研究...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin (versions before 2.8.9 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape data received from payment callbacks before it is displayed on an admin page. Additionally, the integrity che...

CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

PT-2026-103699

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

CVE-2026-102912

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

EUVD-2026-89607

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102912 SourceCodester Online Leave Management System page reports sql injection

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102912 SourceCodester Online Leave Management System page reports sql injection

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

PT-2026-103018

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date start/date end leads to sql injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin, in versions before 4.2.0 (specifically identified as 4.0.0-4.1.3 in some records), is vulnerable to Stored XSS . The root cause is a failure to validate submitted values against stored configurations for certain form types. This allows unauth...

EUVD-2026-82665

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...