7476 matches found
CVE-2026-28289
🚨 CVE-2026-28289 — “Mail2Shell” 通过邮件附件绕过实现 FreeScout 零点击未授权 RCE 📖 概述 CVE-2026-28289 ，别名为 Mail2Shell ，是一个影响 FreeScout 的严重零点击远程代码执行（RCE）漏洞。 攻击者可以向 FreeScout 邮箱发送一封特制邮件，从而在无需身份验证、无需用户交互的情况下获得底层服务器的远程 shell 访问权限 。 🧠 漏洞摘要 字段| 值 ---|--- CVE ID| CVE-2026-28289 严重程度| 🔴 严重 CVSS| 10.0（最高） 攻击向量| 远程（邮件）...
By-Poloss..-..CVE-2026-18080
CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite putcontents $dir . $name, $item'data' ; 文件名 ../../plugins/shell.php 与 $dir（wp-content/uploads/crm-attachments/）拼接后解析为 wp-content/plugins/shell.php —— 一个允许执行 PHP 的目录。 修复版本（v1.17.8）添加了 sanitizeattachmentfilename，该函数通过 basename...
hdwebmobile-photo-video-reviews
HDWebmobile 照片与视频评论 一款 WooCommerce 插件，允许客户在产品评论中附加照片和短视频，并直接显示在产品页面的评论列表中。 WordPress.org： https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ （等待首次提交） 要求： WordPress 6.9+、WooCommerce、PHP 7.4+ 许可证： GPLv2 或更高版本 此插件存在的原因 一款竞品“Customer Reviews for WooCommerce”插件附带了一个独立的 AJAX...
poc-cve-2026-32255
Kan 附件下载 SSRF 漏洞（CVE-2026-32255）- 概念验证 本仓库包含针对 CVE-2026-32255 的概念验证（POC），这是开源项目管理工具 Kan 中存在的一个高严重性服务端请求伪造（SSRF）漏洞。 该漏洞端点允许未认证攻击者从服务器发起任意 HTTP 请求并读取完整响应，从而能够访问内部服务和云元数据端点。 目录 1. 漏洞详情 2. 运行 POC 3. 使用漏洞利用脚本 4. 如何修复漏洞 5. 免责声明 漏洞详情 CVE 信息 CVE ID ：CVE-2026-32255 受影响版本 ：Kan .env 'EOF'...
CVE-2025-29009
CVE-2025-29009 WordPress Medical Prescription Attachment Plugin for WooCommerce 插件 = 1.2.3 存在高优先级任意文件上传漏洞 CVE-2025-29009 Webkul Medical Prescription Attachment — 无限制文件上传 → Web Shell ,-. . , ,--. ,-. ,-. ,-. ;--' ,-. ,-. ,-. ,-. ,-. / | / | / /\ | / /\ / /\ | | / |- --- / | / | / -. --- / -'| | / ...
research-cve-2025-68971
CVE 2025-68971 | Holloway Chew, Kean Ho の知識研究 2025年12月22日、オープンソースアプリケーションForgejo 13.0.3において、FreeBSD14オペレーティングシステム上で初めて検出されたセキュリティ脆弱性CVE 2025-68971（CVSS:...
cve-2020-27358-27359
CVE-2020-27358 / CVE-2020-27359 CVE-2020-27358 および CVE-2020-27359 の悪用手順 CVE-2020-27358 REDCap 8.11.6 から 9.x までの 10 より前のバージョンで問題が見つかりました。メッセンジャーの CSV 機能（ユーザーが会話スレッドを CSV としてエクスポートできる機能）では、非特権ユーザーが、エンドポイント Messenger/messengerdownloadcsv.php?title=Hey&threadid=THREADID へのリクエスト内の threadid...
WordPress Redux Framework plugin <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Attachment Deletion vulnerability discovered by Eunho Kim in WordPress Plugin Redux Framework versions = 4.5.14...
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.14 . The root cause is a failure to properly verify user authorization for specific actions. Authenticated attackers with subscriber-level access and above can exploit this to...
CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1779579653)
The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779579653 advisory. - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorre...
CVE-2026-103476
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...
CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...
CVE-2026-103476
The yii2-starter-kit software, version through 4.2.0 , is vulnerable to an unauthorized file download due to a failure to validate article publication status in the attachment-download endpoint. This flaw allows unauthenticated attackers to bypass authorization checks and retrieve files associate...
EUVD-2026-90207
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...
CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...
CVE-2024-21413
CVE-2024-21413 | Microsoft Outlook リモートコード実行脆弱性 PoC 🚀 使用方法 このスクリプトを使用する前に、対象システムの所有者から適切な許可と承認を得ていることを確認してください。 前提条件 Python 3.x impacket-smbserver 使用例 sudo python3 CVE-2024-21413.py 🛠️ 特徴 メール送信: SMTPを使用して、プレーンテキストとHTMLの両方を含むメールを送信します。 HTMLテンプレート: TemplatesフォルダからHTMLテンプレートを読み取り、プレースホルダーを...
CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ...