GoFileX

GoFileX パスワード保護された GoFile 共有に対してワードリストを試行するための、90年代後半風 IRC クライアント TUI。 文書化された REST API とのみ通信し、レート制限を厳格なルールとして扱う。リクエストは逐次実行、控えめなデフォルト間隔、429 / error-rateLimit に対する指数バックオフ、そして 429 が繰り返された場合の自動一時停止により、クライアントが IP バンに踏み込まないようにする。 作者: @abraxasnull · github.com/abraxas · abraxaslabs.tech ·...

WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability

Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...

CVE-2015-3073

CVE-2015-3073 이 취약점은 원격 공격자가 취약한 Adobe Reader 설치 환경에서 API 제한을 우회할 수 있도록 합니다. 이 취약점을 악용하려면 사용자 상호작용이 필요하며, 대상자가 악성 페이지를 방문하거나 악성 파일을 열어야 합니다. 구체적인 결함은 AFParseDate에 존재합니다. 특정 JavaScript 명령어를 포함한 특수 제작된 PDF를 생성하면 JavaScript API 제한을 우회할 수 있습니다. 원격 공격자는 이 취약점을 악용하여 임의 코드를 실행할 수 있습니다. Windows 및 OS X에서...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-104049

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCE 익스플로잇 Gogs의 CVE-2025-8110 에 대한 자동화된 Python 익스플로잇입니다. 이 취약점은 PutContents API를 악용하여 원격 코드 실행RCE을 가능하게 하며, 해당 API는 파일 경로가 심볼릭 링크인지 검증하지 않습니다. 심볼릭 링크를 통해 내부 .git/config 파일을 덮어씀으로써 악의적인 sshCommand를 주입하여 리버스 셸을 트리거할 수 있습니다. 🛠️ 사전 요구 사항 Python 3 및 필요한 종속성이 설치되어 있는지 확인하세요. pip...

CVE-2023-27742

CVE-2023-27742 IDURAR ERP/CRM v1에서 /api/login 구성 요소를 통해 SQL 인젝션 취약점이 발견되었습니다. 설명 IDURAR ERP/CRM v1에서 /api/login 구성 요소를 통해 SQL 인젝션 취약점이 발견되었습니다. 취약점 유형 SQL 인젝션 공급업체 IDURAR ERP/CRM v1 영향을 받는 제품 코드 베이스 https://github.com/idurar/erp-crm - 버전 1 공격 유형 원격 권한 상승 영향 참 공격 벡터 /api/login 요청의 email 키-값 쌍에...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

EUVD-2026-94186

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816

The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...

EUVD-2026-94176

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2025-12721

g-FFL Cockpit 'returntrue'로 등록되어 인증되지 않은 방문자도 완전히 접근할 수 있습니다. 위치: class-sync-endpoint.php: 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', // Public endpoint 92: ; handleserverstat...

CVE-2025-65427

CVE-2025-65427: Dbit N300 T1 Pro의 인증 속도 제한 문제 CVE ID: CVE-2025-65427 날짜: 2025-12-16 발견자: Kirubel 제품: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 펌웨어 버전: V1.0.0 설명 Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 펌웨어 버전 V1.0.0에서 문제가 발견되었습니다. 이 장치는 /api/login 엔드포인트에 속도 제한rate limiting을 구현하지...

CVE-2026-96594

A flaw was found in Gitea. The repository media application programming interface API endpoint does not return appropriate content-type and disposition security headers when serving small files directly from a repository. An authenticated attacker with repository push access can commit a maliciou...

CVE-2026-105268

A flaw was found in Gitea. The Application Programming Interface API endpoints handling issue attachments improperly process attachments associated with comments on that issue. An authenticated user who created an issue can exploit this flaw to rename or delete attachments posted by other users i...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect 원격 코드 실행 RCE CVE-2023-43208 에 대한 개념 증명 익스플로잇으로, 인증되지 않은 원격 코드 실행 취약점이며 Mirth Connect 버전 4.4.1 미만에 영향을 줍니다. 설명 Mirth Connect는 널리 배포된 오픈소스 의료 통합 엔진입니다. 이 취약점은 /api/users 엔드포인트를 통해 조작된 XML 페이로드를 사용하여 Apache Commons Collections 가젯을 체인화하는 Java 역직렬화 결함을 악용하여 인증되지 않은 RCE를...