CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-104073

A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...

CVE-2026-85706

CVE-2026-85706 Lectura arbitraria de archivos sin autenticación en GitLab ★ PoC de lectura arbitraria de archivos sin autenticación en GitLab CVE-2026-85706 ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d Descripción general CVE-2026-85706 es una lectura arbitrar...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 针对 CVE-2025-54236 （"SessionReaper"）的统一 PoC，该漏洞是 Magento 2 / Adobe Commerce 中通过 REST API 的嵌套反序列化实现的关键未认证 RCE。 CVSS： 9.1（严重） 根本原因： ServiceInputProcessor 中的输入验证不当（CWE-20）；利用原语为不安全的反序列化（CWE-502） 原始研究员： Daniel "Blaklis" Le Gall（通过 HackerOne 负责任的披露） 命名者： Sansec 修复版本： Adob...

CVE-2024-39722

Ollama CVE-2024-39722 利用工具 该工具旨在利用 CVE-2024-39722，这是 Ollama 版本 = 0.1.45 中的一个模型存在性泄露漏洞。它允许用户检查 Ollama 服务器是否存在漏洞，并尝试发现服务器上存在的模型。此外，它还可以爬取 Ollama 官方模型库以生成用于测试的潜在模型列表。 漏洞详情 CVE ID: CVE-2024-39722 描述: Ollama 版本 = 0.1.45 存在模型存在性泄露漏洞。通过向 /api/push 端点发送特制请求，攻击者可以确定特定模型（包括不在公共库中的自定义模型）是否存在于服务器上。 受影响版本: =...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - 版本 2020.7 在 Damstra Smart Asset 2020.7 的 API/api/Version 中发现了一个问题。 跨域资源共享信任随机来源，接受任意的 'Origin: example.com' 头，并响应 200 OK 和通配符 'Access-Control-Allow-Origin: ' 头。 HTTP 请求： GET /API/api/Version HTTP/1.1 Origin: https://StudniarzLukasz.com 发...

CVE-2026-107103

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107102

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2022-2414

CVE-2022-2414 CVE-2022-2414 POC 1. 将 YOURHOST 替换为你的目标，如下所示 url url = "https://example.com/ca/rest/certrequests"...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103

A SQL Injection vulnerability exists in the Manacle Technologies ERP System due to insufficient validation and parameterization of user-supplied input in an API endpoint . An unauthenticated remote attacker can exploit this by providing specially crafted input to the vulnerable endpoint. Successf...

EUVD-2026-94218

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107102

The Manacle Technologies ERP System contains an account takeover vulnerability due to improper validation of payment callback parameters and inadequate authentication controls within an API endpoint. An unauthenticated remote attacker can manipulate specific parameters to force the application to...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

GoFileX

GoFileX Cliente TUI de IRC de finales de los 90 para recorrer wordlists contra un recurso compartido de GoFile protegido por contraseña. Solo se comunica con la API REST documentada y trata los límites de velocidad como una regla estricta: solicitudes secuenciales, un intervalo predeterminado...

WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability

Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...

CVE-2015-3073

CVE-2015-3073 此漏洞允许远程攻击者绕过 Adobe Reader 受安装版本中的 API 限制。利用此漏洞需要用户交互，即目标必须访问恶意页面或打开恶意文件。 具体缺陷存在于 AFParseDate 中。通过创建包含特定 JavaScript 指令的特制 PDF，可以绕过 JavaScript API 限制。远程攻击者可利用此漏洞执行任意代码。 Windows 和 OS X 上，Adobe Reader 和 Acrobat 10.1.14 之前的 10.x 版本以及 11.0.11 之前的 11.x 版本受此漏洞影响。 注意： 代码假设你已将名为 exploit.txt 的...