CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 は、Fortinet FortiWeb の Fabric Connector コンポーネントに影響を及ぼす、認証前 SQL インジェクションの重大な脆弱性です。影響を受ける FortiWeb のバージョンは以下の通り: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 技術的詳細 この問題は、サニタイズされていないユーザー入力（Authorization: Bearer HTTP ヘッダー）を使用して SQL クエリを構築する getfabricuserbytoken...

CVE-2022-3172

CVE-2022-3172 데모 poc.sh를 실행하여 리소스 생성 root@kitploit: chmod +x poc.sh ./poc.sh Curl 사용 root@kitploit: curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

SnaffPoint

SnaffPoint これは何か SnaffPoint は、この世界に甘美さを必要とするペネトレーションテスターのためのツールです。SharePoint Online 上や、会社または顧客の共有 OneDrive ファイル上で利用可能な機密ファイルを見つけるのに役立ちます。 どのように動作するか 実際には2つのツールがあります: GetBearerToken は、通常の GUI と MFA 対応で SharePoint への認証を実行します SnaffPoint は CLI のみで、列挙自体と興味深いファイルの発見を行います GetBearerToken...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-85154

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

EUVD-2026-70389

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154

WWBN AVideo contains an authentication failure in its video_id_hash credential, which acts as a non-expiring, non-revocable bearer token granting full administrator session access to the video owner's account. An attacker who obtains this token can replay it indefinitely to authenticate as the ow...

poc_cve-2026-42208

CVE-2026-42208 — LiteLLM 事前認証SQLインジェクション CVE-2026-42208 を再現・検出するためのラボ環境です。これはLiteLLMにおける重大な事前認証SQLインジェクション脆弱性で、サニタイズされていないBearerトークンが生のPostgreSQLクエリに到達します。 脆弱性概要...

CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM 事前認証SQLインジェクションのタイミングPoC CVE-2026-42208（LiteLLM ProxyのAPIキー検証パスにおける事前認証SQLインジェクションの脆弱性）のためのローカルDockerラボおよび最小限の害を伴うPoCです。 このリポジトリは、タイミングベースのPostgreSQL pgsleep 証明を使用して、脆弱なLiteLLMインスタンスとパッチ適用済みLiteLLMインスタンスの違いを示します。 適用範囲: ローカルラボ / 許可されたテストのみ。デフォルトのPoCはデータベースデータのダンプや変更を行いません。...

PT-2026-84986

WWBN AVideo contains an authentication failure vulnerability where the video id hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video id hash can replay it indefinitely to authenticate...

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token...

CVE-2026-18730 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

EUVD-2026-67065

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...