CVE-2026-108609 JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CVE-2026-108609

JeecgBoot versions up to and including 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /airag/voice/listByUser endpoint. The root cause is an improper authorization check on the userId parameter, allowing authenticated users to access the AI voice generatio...

CVE-2026-108609

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CVE-2026-108608

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The issue exists in the DELETE /airag/voice/deleteVoiceRecord endpoint, where authenticated users can delete the AI voice records of other users by providing an arbitrary userId parameter. Addition...

CVE-2026-108608

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108608 JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108608 JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108607 JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

CVE-2026-108607

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the AI video generation module. Authenticated users can delete other users' AI video generation records by providing arbitrary userId values to the DELETE /airag/video/deleteVideoRecord ...

CVE-2026-108607 JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

CVE-2026-108607

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

CVE-2024-45409

Ruby-SAML / GitLab Authentifizierungs-Bypass CVE-2024-45409 Exploit Dieses Skript nutzt die CVE-2024-45409 aus, die es einem nicht authentifizierten Angreifer mit Zugriff auf ein signiertes SAML-Dokument des IDP ermöglicht, eine gefälschte SAML-Antwort/-Assertion zu erstellen und sich als...

CVE-2026-78306

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

veinmind-tools

veinoind-tools Documentazione Veinoind-tools è una suite di strumenti di sicurezza per container sviluppata internamente da Chaitin Technology e incubata dal team Muyun, basata su veinmind-sdk Veinoind, in cinese chiamato 问脉 , significa toccare il polso della sicurezza dei container, osservare,...

FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after...

FinalRecon

Twitter - Telegram - il blog di thewhiteh4t FinalRecon è uno strumento di ricognizione web automatico tutto in uno scritto in Python. L'obiettivo di FinalRecon è fornire una panoramica del bersaglio in breve tempo, mantenendo l'accuratezza dei risultati. Invece di eseguire diversi strumenti uno...

ThreatExchange

Progetti in questo Repository Questo repository è nato originariamente come codice a supporto dell'API ThreatExchange di Meta, ma nel tempo è cresciuto fino a includere una serie di progetti a supporto dello scambio di segnali e della moderazione dei contenuti in generale. Di seguito è riportato ...

SILENTTRINITY

SILENTTRINITY SILENTTRINITY è un framework C2/post-exploitation moderno, asincrono, multi-player e multi-server basato su Python 3 e DLR di .NET. È il risultato di un'estesa ricerca sull'uso di linguaggi di scripting .NET embedded di terze parti per chiamare dinamicamente API .NET, una tecnica ch...

content

Benvenuti! Lo scopo di questo progetto è creare contenuti di policy di sicurezza per varie piattaforme — Red Hat Enterprise Linux , Fedora , Ubuntu , Debian , SUSE Linux Enterprise Server SLES ,... — e prodotti — Firefox ,... Il nostro obiettivo è rendere il più semplice possibile scrivere nuovi...

naabu

Features • Installation • Usage • Running naabu • Config • NMAP integration • CDN/WAF Exclusion • Discord Naabu is a port scanning tool written in Go that allows you to enumerate valid ports for hosts in a fast and reliable manner. It is a really simple tool that does fast SYN/CONNECT/UDP scans o...