CVE-2026-25099

CVE-2026-25099 - Bludit CMS API 無制限ファイルアップロードによるRCE 説明 Bludit CMS 3.18.4 より前のバージョンでは、有効なAPIトークンを持つ認証済み攻撃者が、POST /api/files/ エンドポイントを介して任意のタイプおよび拡張子のファイルをアップロードできます。uploadFile 関数はファイル拡張子やコンテンツの検証を一切行わないため、PHPウェブシェルをアップロードして www-data として実行することが可能です。 影響を受けるバージョン 脆弱性あり: Bludit 3.18.4 修正済み: Bludit...

CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

CVE-2026-84803

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in its asset-serving component. The root cause is an incomplete extension blocklist that fails to cover script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf, which resolve to executable media typ...

EUVD-2026-69915

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 のIP制限バイパスとデフォルトのadmin AIPトークンを使用したリモートコード実行 完全なウォークスルー https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS の安全でない API トークン生成による権限昇格 NVD • Advisory • CWE-639 概要 StudioCMS ≤ 0.3.0 の POST /studiocmsapi/dashboard/api-tokens エンドポイントは、認証済みユーザー（最低でも Editor ロール）が 他の任意のユーザー （owner や admin アカウントを含む）の API トークンを生成することを許可します。 このエンドポイントは、リクエストボディ内の user パラメータで対象ユーザーの UUID...

CVE-2021-41805

CVE-2021-41805 API経由のHashicorp Consul RCE HashiCorp Consul Enterprise 1.8.17 未満、1.9.x は 1.9.11 未満、および 1.10.x は 1.10.4 未満には、不適切なアクセス制御があります。あるネームスペースの ACL トークン デフォルトの operator:write 権限を持つもの は、別のネームスペースでの意図しない権限昇格に使用される可能性があります。 概要 CVEID : CVE-2021-41805 基本スコア : 8.8 深刻度 : 高 発行日 : 2021-12-12...

LEAKEY

LEAKEY 🔑 LEAKEYは、ペネトレーションテストやRed Teamエンゲージメント中に見つかった漏洩したAPIトークン/キーの検証ツールです。 このスクリプトは、バグハンターが漏洩した認証情報の影響を検証・判断するのに非常に役立ちます。 LEAKEYは、/.leakey/signatures.json にあるJSONベースのシグネチャファイルを使用します。 LEAKEYの背後にあるアイデアは、高度にカスタマイズ可能で、新しいサービス/チェックが発見されたら簡単に追加できるようにすることです。...

CVE-2023-48084

CVE-2023-48084 修复了 POC 中的语法错误，主要是错误的导入和对 API 函数的错误引用。 自动化 APIToken 的获取，将令牌存储为变量并输入到修复后的 POC 中。 https://github.com/Hamibubu/CVE-2023-48084 如果由于某种原因这不起作用，请对上面链接的依赖项进行差异检查，并还原我的更改。 安装 root@kitploit: git clone https://github.com/bucketcat/CVE-2023-48084 cd https://github.com/bucketcat/CVE-2023-48084...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

EUVD-2026-66223

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-82882

Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

EUVD-2026-68773

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909

QuantumNous new-api versions up to 1.0.0-rc.15 are affected by a vulnerability in the Revoked API Token Handler (file /api/usage/token/). Manipulation of an unknown function in this component can lead to session expiration . The attack is remote and requires low privileges , with a low confidenti...

CVE-2026-81853

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...