running-CVE-2024-32002-locally-for-tesing

We are adapting this for local use we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce How It Works 1. A malicious repository gitrce includes a submodule with a specially crafted path. 2. The submodule path uses a case variation that exploits the...

CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria introduced with the CVE-2026-71510 fix uses a case-sensitive inarray while the operand charset allows A-Z. Since SQL column resolution is...

CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-sensitivity bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while t...

CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE-2018-17418 Code analysis: In line 150 of monstra\plugins\box\filesmanager\filesmanager.admin.php, there is a forbiddentypes variable used as a blacklist restriction. Continue to follow this variable. In the line 150 of...

CVE-2026-17409

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of...

CVE-2026-17085

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it...

CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of...

EUVD-2026-118789

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of...

CVE-2026-17409

IBM API Connect versions v12.1.0.0 through v12.1.1.2 (and v10.0.8.0 through v10.0.8.12) are vulnerable to multiple issues, including CVE-2026-17409 . This specific vulnerability stems from improper handling of case sensitivity , where access controls are inconsistently applied to different variat...

EUVD-2026-118627

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it...

CVE-2026-17085

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to multiple vulnerabilities where a remote authenticated attacker can bypass security restrictions. The root cause is the improper handling of case sensitivity , where access restrictions are not app...

PT-2026-139153

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.12 IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description Improper handling of case sensitivity allows a remote attacker to execute unauthorized administrative operations and obtain...

CVE-2026-85287 HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can regist...

CVE-2026-85287

The home inventory system HomeBox is vulnerable to an email case-sensitivity bypass in versions prior to 0.27.0 . The POST /api/v1/users/register endpoint and the users.email uniqueness constraint treat email addresses as case-sensitive, whereas the login lookup process is case-insensitive. An un...

CVE-2026-85287 HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can regist...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.3 Vulnerability Details CVEID:CVE-2026-17403 DESCRIPTION: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of...

EUVD-2026-117331

In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner...

Security Bulletin: IBM Test Accelerator for Z uses fast-uri-3.1.7.tgz, which is vulnderable to CVE-2026-86472

Summary IBM Test Accelerator for Z uses fast-uri-3.1.7.tgz, which is vulnderable to CVE-2026-86472. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-86472 DESCRIPTION: fast-uri is a dependency-free RFC 3986 URI...

CVE-2026-63121 Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...