CVE-2021-38647

CVE-2021-38647 这是一个针对 CVE-2021-38647 的 POC： 发送一个 POST 请求到 /wsman，请求体包含 payload.xml 的内容，只需将命令替换为你想要的命令， 作为 POC，仅执行 id 命令。 来源：https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure 喜欢的话请关注：https://twitter.com/silentgh00st...

metabase-cve-2023-38646

cd /metabase-poc cat README.md -p 4444 -P 8000 -u http://localhost:3000 -l — 攻击者回调 IP（当目标为本地容器时，通常为 Docker 桥接网关，例如 172.17.0.1） -p — 反向数据通道回连的端口 -P — 提供加载器脚本的本地 HTTP 服务器端口 -u — 目标 Met...

letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study 针对 Palo Alto PAN-OS GlobalProtect 门户的 CVE-2024-3400 利用尝试的检测、分析与响应策略。包含 IOC、利用模式及缓解指南。 CVE-2024-3400 事件调查 🔍 概述 本仓库包含对 CVE-2024-3400 的详细调查与威胁分析。CVE-2024-3400 是一个影响 Palo Alto Networks PAN-OS 软件、专门针对 GlobalProtect 门户的严重未授权命令注入漏洞。 2024 年 4 月 18 日，在一台内部 PAN-OS...

CVE-2026-104964

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2026-104955

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-104894

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-22557-Path-Traversal-Ubiquti-UniFi

CVE-2026-22557 パストラバーサル Ubiquti UniFi Network Application このリポジトリは、UniFi Network Application を対象とした CVE-2026-22557 の Go ベースの概念実証スキャナーです。このツールは、一連の一般的なエンドポイントとトラバーサルペイロードに対して、制御された非破壊的なスキャンを実行し、潜在的に脆弱な動作を特定します。 概要 このプログラムは以下のように設計されています: IP アドレス、ホスト名、または完全な URL からターゲット URL を構築する いくつかの一般的な UniFi...

CVE-2026-104969 Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

EUVD-2026-92491

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

CVE-2026-104964

The project management tool Plane is vulnerable to a cross-workspace project modification flaw in versions prior to 1.4.0 . The vulnerability exists because the project update endpoint validates the workspace slug in the URL but fetches the target project globally using its UUID without verifying...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

EUVD-2026-92486

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2024-40422

CVE-2024-40422 CVE-2024-40422 的 Python 实现/PoC。利用 Devika v1 的 /api/get-browser-snapshot 端点中存在的严重目录遍历漏洞，以读取任意系统文件。...

CVE-2023-25157-checker

CVE-2023-25157-checker golangで書かれたスクリプトです。CVE-2023-25157のPoCです。 使い方 1. git clone https://github.com/7imbitz/CVE-2023-25157-checker.git 2. cd CVE-2023-25157-checker 3. go run CVE-2023-25157.go は対象サーバーのURLに置き換えてください。 Google Dork inurl:"/geoserver/ows?service=wfs" 研究について...

EUVD-2026-92480

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

PoC-for-CVE-2021-38540-

CVE-2021-38540 概念実証 CVE-2021-38540として知られる重要なコンポーネントにおける認証欠如 このバグについて: 変数インポートエンドポイントは、Airflow =2.0.0, =2.0.0, variables 変数のリスト の下に kafkacaptainhookuser という名前の変数を作成するリクエストを含んでいます。 PoCソース: POST /variable/varimport HTTP/2 Host: airflow.example.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:91.0...

CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-104894

The open-source project management tool Plane is vulnerable to a cross-tenant issue linking flaw via an IDOR (Insecure Direct Object Reference) vulnerability in versions prior to 1.4.0 . The modules endpoint fails to validate that issue UUIDs provided in the URL path belong to the caller's worksp...