CVE-2025-492030

CVE-2025-492030 安全公告：CVE-2025-492030 概述 SecureVPN 应用程序中发现了一个严重漏洞，该漏洞可通过一个脆弱的API端点实现账户接管 。此缺陷可能使攻击者能够未经授权访问用户账户，从而可能暴露敏感数据并危及用户隐私。 漏洞详情 CVE ID ：CVE-2025-492030 严重性 ：严重 影响 ：账户接管 受影响组件 ：SecureVPN API 端点 攻击向量 ：远程 技术细节 该漏洞存在于 SecureVPN API 的认证机制中。具体来说： 1. 端点 ：/api/v1/authenticate 2. 问题...

CVE-2023-34035-Poc

CVE-2023-34035: Incorrect Authorization...

astDoS

astDoS 用于利用CVE-2018-7284和CVE-2018-19278的工具 用法 该工具作为命令行使用。 root@kitploit: astDoS.py -h -a 1,2 -sA SERVERIP -sP SERVERPORT -u USER -p PASSWD -sub SUBUSER -dA DNSIP -dP DNSPORT -v VERSION DoS attack against Astersisk, CVE-2018-7284 and CVE-2018-19278 optional arguments: -h, --help show this help...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

CVE-2026-86192

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86194

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious...

CVE-2026-86186

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

changedetection.io v0.60.3

Detect Website Changes Automatically — Monitor Web Page Changes in Real Time Monitor websites for updates — get notified via Discord, Email, Slack, Telegram, Webhook and many more. Detect web page content changes and get instant alerts. Ideal for monitoring price changes, content edits, condition...

dirtycow-lab

Dirty COW Educational PoC CVE-2016-5195 ⚠️ Legal Warning This code is for EDUCATIONAL PURPOSES ONLY. Any malicious use is strictly prohibited and illegal. 📖 What is Dirty COW? Dirty COW CVE-2016-5195 is a privilege escalation vulnerability in the Linux Kernel that exploits a race condition in the...

CVE-2025-55182-Attack-Analysis

CVE-2025-55182 Attack Analysis: React Server Components RCE Real-world attack analysis on a production Next.js application 📋 Table of Contents Executive Summary Vulnerability Overview Attack Timeline Technical Analysis Malware Analysis Indicators of Compromise IOCs Mitigation & Response Lessons...

Exploit for Improper Authorization in Vercel Next.Js

CVE-2025-29927 – Next.js Middleware Authorization Bypass Verif...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - 通过 handleRequest 缺少授权 描述： RumbleTalk Live Group Chat WordPress 插件在版本 6.1.9 及之前存在缺失对 handleRequest AJAX 函数的能力检查，导致未授权访问数据、修改数据和丢失数据。这使得经过身份验证的攻击者（至少拥有订阅者级别访问权限）能够检索或更新令牌、创建、更新、刷新和删除聊天，以及创建账户。 root@kitploit: Severity: high CVE ID: CVE-2023-45828...

cve-2024-3552

描述 Web Directory Free（WordPress）插件在 1.7.0 之前的版本存在 SQL 注入漏洞。AJAX 执行函数未经过充分的过滤/净化（sanitise），允许攻击者使 SQL 查询失效或注入额外的子句（UNION、时间型、报错型） 上下文 WordPress 版本 5.8 web-directory-free 插件版本 1.6.9 MySQL 版本 5.7 源代码 在文件 ajax-controller.php → 类 w2dcajaxcontroller → 函数 getmapmarkerinfo 中 1. 直接通过 $POST'locationsids'...

asf__cxf_CVE-2019-17573_3-2-11

¡Bienvenido a Apache CXF! Apache CXF es un marco de trabajo de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios mediante API de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, RESTful HTTP o...

yakit v1.4.8-0905

YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper • Official documentation • Issue feedback • Official website • Community • Architecture :book:Language： English • 中文 Introduction Security integration is a reform of security operations and management for enterprises in t...

CVE-2026-15550

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-12843

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

EUVD-2026-71998

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious...

CVE-2026-86196 Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious...