DLLHijackHunter

DLLHijackHunter By ProjectMerai 自動化されたDLLハイジャックの発見、検証、確認 ローカルの設定ミスを、武器化された確定済みの攻撃経路へと変える。 概要 DLLHijackHunter は、静的解析を超えた自動化されたWindows DLLハイジャック検出ツールです。多段階パイプラインを使用して、DLLハイジャックの機会を発見、検証、確認します： 1. 発見 — サービス、スケジュールタスク、スタートアップ項目、COMオブジェクト、AutoElevate UACバイパスベクターにわたるバイナリを列挙します 2. フィルタリング —...

XWiki DeleteApplication - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2023-36644

== 影響を受けるソフトウェア %hardbreaks ベンダー: ITB-GmbH 影響を受ける製品: TradePro v9.5 コンポーネント: Printmail Plugin 確認済み: はい == 攻撃ベクトル %hardbreaks タイプ: 不適切なアクセス制御 アクセスタイプ: リモート 影響: 情報漏えい ITB-GmbH TradePro v9.5 の printmail プラグインにおける不適切なアクセス制御により、リモートの攻撃者が任意の注文番号を https エンドポイントに渡すことで、オンラインショップからすべての注文確認書を取得できます。 == 説明...

XSSYA

XSSYA-V2.0 がリリースされました - 確認: https://github.com/yehia-mamdouh/XSSYA-V-2.0 XSSYA は、クロスサイトスクリプティングスキャナ & 脆弱性確認（2つのメソッドで動作） • メソッド1: 確認のためのリクエストとレスポンス • メソッド2: 確認のため、エンコードされたペイロードを実行し、デコードされた同じペイロードをWeb HTMLコード内で検索します • HTTPS をサポート • 確認後（ペイロードを実行してクッキーを取得） • 3種類のWAFを識別（ModSecurity - WebKnight - F5 BI...

CVE-2026-104439

YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...

CVE-2026-51876

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed bookid to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

PT-2026-104009

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2 Description App-based multi-factor authentication MFA management actions do not consistently require confirmation of the current password. An attacker with access to ...

CVE-2024-9166

CVE-2024-9166 脆弱性スキャナ CVE-2024-9166 脆弱性をスキャンするための Python ベースのツールです。これは（本リポジトリ公開時点で）最新のものの一つです。 脆弱なパターンをチェックし、脆弱性をテストして確認し、結果をファイルに記録します。 私はこのツールの誤用について一切の責任を負いません。このツールは倫理的なハッキングに使用することを目的として作成されました。同意なしにペネトレーションテスト（およびあらゆる種類のハッキング）を行うことは違法であり、深刻な結果を招く可能性があります！ インストール ツールをインストールするには、以下の単一のコマンドでこの...

CVE-2026-59563

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...

CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...

EUVD-2026-88244

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...

CVE-2026-59563

The Zscaler MCP Server versions 0.7.0 and 0.7.1 are vulnerable to a token replay issue. The root cause is that HMAC confirmation tokens are not bound to the target resource identifier. This allows an MCP client or agent to replay a token intended for one resource to impact another resource of the...

CVE-2026-59563 HMAC Confirmation Token Unbinding in zscaler-mcp-server

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...

CVE-2026-89411

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

CVE-2026-59563: Authentication Bypass by Primary Weakness

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2...

CVE-2025-43929

CVE-2025-43929 CVE-2025-43929の概念実証。KiTTYにおける高重要度の脆弱性で、特定の状況下でユーザーの確認なしにローカル実行可能ファイルが実行される可能性があります。 Vulnerability Type CWE-346: CWE-346 Origin Validation Error Vulnerability Description kitty 0.41.0より前のバージョンにおけるopenactions.pyは、信頼されていないドキュメント（例：KDE...