CVE-2026-50281

Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...

Remote Code Execution

Craft CMS is vulnerable to Remote Code Execution. The vulnerability is due to the beforeAction not properly validating the parameter leading to malicious code execution...

phpwind9.x 通讯秘钥安全漏洞

来源链接：phpwind 利用哈希长度扩展攻击进行getshell 一哥新发的漏洞，还是蛮屌的： http://www.wooyun.org/bugs/wooyun-2016-0210850。分析补丁（ http://www.phpwind.net/read/3709549 ）加上一些风闻，我得知利用的是哈希长度扩展攻击。之前CTF中经常出境的MD5 Length Extension Attack，终于在实战中露了一次面。 0x01 漏洞点分析 phpwind逻辑太冗杂了，一看就是java程序员开发的。...