CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-104073

A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...

CVE-2026-85706

CVE-2026-85706 GitLab 비인증 임의 파일 읽기 ★ CVE-2026-85706 GitLab 비인증 임의 파일 읽기 PoC ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d 개요 CVE-2026-85706 은 GitLab CE/EE 의 비인증 임의 파일 읽기 취약점CVSS 10.0, CISA KEV으로, POST /api/v4/projects/:id/repository/commits를 통해 악용됩니다. 이 엔드포인트의...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 CVE-2025-54236 "SessionReaper"를 위한 통합 PoC, Magento 2 / Adobe Commerce의 REST API에서 중첩 역직렬화를 통한 중요한 인증되지 않은 RCE입니다. CVSS: 9.1 심각 근본 원인: 부적절한 입력 검증 CWE-20; 익스플로잇 기본 요소는 안전하지 않은 역직렬화 CWE-502 최초 연구자: Daniel "Blaklis" Le Gall HackerOne을 통한 책임 공개 명명자: Sansec 수정 버전: Adobe...

CVE-2024-39722

Ollama CVE-2024-39722 익스플로잇 도구 이 도구는 Ollama 버전 0.1.45 이하에서 발생하는 모델 존재 여부 노출 취약점인 CVE-2024-39722를 익스플로잇하기 위해 설계되었습니다. 사용자는 Ollama 서버가 취약한지 확인하고 서버에 존재하는 모델을 발견하려 시도할 수 있습니다. 또한 공식 Ollama 모델 라이브러리를 크롤링하여 테스트할 잠재적 모델 목록을 생성할 수 있습니다. 中文 취약점 세부 정보 CVE ID: CVE-2024-39722 설명: Ollama 버전 0.1.45 이하는 모델 존재 ...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - 버전 2020.7 Damstra Smart Asset 2020.7의 API/api/Version에서 문제가 발견되었습니다. 교차 출처 리소스 공유CORS가 무작위 출처를 신뢰하여 임의의 'Origin: example.com' 헤더를 수락하고 200 OK 및 와일드카드 'Access-Control-Allow-Origin: ' 헤더로 응답합니다. HTTP Request: GET /API/api/Version HTTP/1.1...

CVE-2026-107103

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107102

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2022-2414

CVE-2022-2414 CVE-2022-2414 POC 1. 아래 url과 같이 YOURHOST를 대상 호스트로 교체하십시오 url = "https://example.com/ca/rest/certrequests"...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

EUVD-2026-94218

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103

A SQL Injection vulnerability exists in the Manacle Technologies ERP System due to insufficient validation and parameterization of user-supplied input in an API endpoint . An unauthenticated remote attacker can exploit this by providing specially crafted input to the vulnerable endpoint. Successf...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107102

The Manacle Technologies ERP System contains an account takeover vulnerability due to improper validation of payment callback parameters and inadequate authentication controls within an API endpoint. An unauthenticated remote attacker can manipulate specific parameters to force the application to...

GoFileX

GoFileX パスワード保護された GoFile 共有に対してワードリストを試行するための、90年代後半風 IRC クライアント TUI。 文書化された REST API とのみ通信し、レート制限を厳格なルールとして扱う。リクエストは逐次実行、控えめなデフォルト間隔、429 / error-rateLimit に対する指数バックオフ、そして 429 が繰り返された場合の自動一時停止により、クライアントが IP バンに踏み込まないようにする。 作者: @abraxasnull · github.com/abraxas · abraxaslabs.tech ·...

WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability

Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...

CVE-2015-3073

CVE-2015-3073 이 취약점은 원격 공격자가 취약한 Adobe Reader 설치 환경에서 API 제한을 우회할 수 있도록 합니다. 이 취약점을 악용하려면 사용자 상호작용이 필요하며, 대상자가 악성 페이지를 방문하거나 악성 파일을 열어야 합니다. 구체적인 결함은 AFParseDate에 존재합니다. 특정 JavaScript 명령어를 포함한 특수 제작된 PDF를 생성하면 JavaScript API 제한을 우회할 수 있습니다. 원격 공격자는 이 취약점을 악용하여 임의 코드를 실행할 수 있습니다. Windows 및 OS X에서...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...