svn-extractor

Svn-Extractor Webアプリケーションのペネトレーションテスターは、.svnフォルダーの存在にしばしば遭遇します。ご存じない方のために説明すると、.svnフォルダーはSVNバージョン管理システムがその操作を実行するために使用するフォルダーです。ブラックボックスペンテストでは、このフォルダーには膨大な量の情報が含まれています。 これが役立つ主な分野には、次のようなものがあります。 1. 隠しファイルやフォルダー名を明らかにする 2. ファイルのソースコードにアクセスする 3. htaccess で制限が設定されている場合でもファイルをダウンロードする...

CVE-2025-55183

CVE-2025-55183 React Server Functions 소스 코드 노출 취약점 스캐너. 이게 무엇인가요? CVE-2025-55183: React 19.0.0-19.2.1의 Server Actions를 악용하여 전체 소스 코드하드코딩된 비밀, API 키, 데이터베이스 자격 증명 포함를 노출시킬 수 있습니다. 참조: https://github.com/facebook/react/commit/894bc73cb493487c48d57f4508e6278db58e673a...

CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9...

react-server-cve-lab

React Server Components 보안 연구소 CVE-2025-55183 & CVE-2025-55184 CVE-2025-55183소스 코드 노출 및 CVE-2025-55184서비스 거부 취약점에 대한 종합적인 보안 테스트 환경입니다. ⚠️ 면책 조항 교육 및 보안 연구 목적으로만 사용하세요 이 저장소는 의도적으로 취약하게 만든 애플리케이션과 익스플로잇 도구를 포함하고 있습니다. 자신이 소유하거나 명시적인 서면 허가를 받은 시스템에서만 테스트하세요. 무단 테스트는 불법이며 비윤리적입니다. 📋 목차 취약점 정보 빠른 시작...

CVE-2024-38475

CVE-2024-38475 CVE-2024-38475modrewrite 파일시스템 경로 매칭 취약점를 이용한 익스플로잇 이 저장소는 웹 서버 취약점 테스트를 위한 Python 스크립트를 포함하며, 특히 Apache 서버를 대상으로 합니다. 이 스크립트는 디렉토리 및 파일용 워드리스트를 사용하여 노출된 소스 코드에 대한 잠재적 문제modrewrite 파일시스템 경로 매칭 취약점를 확인하고 다양한 페이로드를 적용합니다. 사용법: 스크립트를 실행하려면 다음 명령어를 사용하세요: root@kitploit: python3 script....

CVE-2026-32662

CVE-2026-32662: 本番環境におけるアクティブデバッグコード 勧告 項目| 値 ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3（中） ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489（アクティブデバッグコード） 研究者| Michael Groberman — Gr0m 公開日| 2026-04-02（Update A） 製品 項目| 値 ---|--- ベンダー| Gardyn 製品| Gardyn...

nextjs-security-update

nextjs-security-update 新たなNext.jsの脆弱性を悪用するOSSツールを開発する人々がいます。これは対抗するためのツールです。すべてのNext.jsアプリを、すべてのGitHubアカウントにわたって極めて簡単にアップグレードできます。 内部では公式Vercel修正ツールを使用しています。 何が起きたか 2025年12月11日：Next.jsは、App Routerを使用するReact Server Componentsに影響する複数の重大な脆弱性を開示しました。 CVE-2025-66478 RCE CVE-2025-55183 Source Code...

CVE-2026-84149

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

EUVD-2026-69059

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and earlier, the CVE-2026-16581 describes an Inclusion of Sensitive Information in Source Code that could allow an unauthorized actor to access functions or backend services not sufficiently protected by authentication controls. The affected softw...

CVE-2026-16581

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597

CVE-2026-13597 affects the WordPress plugin for 微信二维码登陆 (QR code login) versions

EUVD-2026-45187

Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...

CVE-2026-14503 pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...