CVE-2026-25197

CVE-2026-25197：通过用户可控密钥绕过授权（IDOR） 安全公告 字段| 值 ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03（更新 A） CVSS 3.1| 9.1（严重） 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639（通过用户可控密钥绕过授权） 研究人员| Michael Groberman — Gr0m 发布日期| 2026-04-02（更新 A） 产品 字段| 值 ---|--- 厂商| Gardyn 产品| Gardyn Home Kit...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2026-41573

OpenAM prior to 16.1.1 is vulnerable to LDAP injection via the _queryId parameter in CREST REST API user query endpoints (/json/{realm}/users). The root cause is that IdentityResourceV1.queryCollection() passes _queryId to CrestQuery with escapeQueryId explicitly set to false , bypassing the esca...

CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2025-13166

WSO2 Identity Server is affected by a username enumeration vulnerability in its SMS OTP flow . The root cause is that the OTP initiation process returns differing error messages depending on whether the queried account exists and has a mobile number configured, allowing an attacker to infer valid...

KUMO-Domain-Recon-Tool

一个域名。一条命令。尽览一切。 Kumo 是一个域名 OSINT 与安全侦察框架。输入一个域名——即可通过 26 个并行模块 实时获取全部信息：DNS、开放端口、泄露凭据、信息窃取程序感染、存在漏洞的端点、子域名、CVE、恶意软件家族等。bash pip install requests flask python3 kumo.py target.com full CLI scan python3 kumo.py target.com --fast fast mode skips slow modules python3 kumo.py --web web UI →...

Advanced-SQL-Injection-Cheatsheet

MySQL 基于错误的 SQL 注入速查表 这可能是 SQL 注入攻击中最容易利用的一类漏洞。攻击者可以利用 SQL 错误消息来枚举并转储 MySQL 数据库。 检测漏洞http://domain.com/index.php?id=1 Website loads successfully http://domain.com/index.php?id=1' 错误信息显示为：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the...

CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

atutor-blind-sqli

ATutor v2.2.1 盲 SQL 注入 利用 CVE-2016-2555 枚举并导出底层数据库。 免责声明 本文提供的所有信息仅供教育目的。 您不应滥用这些信息来获取未授权访问和/或编写恶意程序。 作者不对信息的滥用负责。...

EUVD-2026-78249

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

onedrive_user_enum

onedriveuserenum v2.10 枚举有效的 OneDrive 用户 有关枚举技术和 OneDrive 枚举的完整说明，请参阅以下博客： https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ 如果你在寻找旧的、非数据库版本的 OneDrive Enum，可以在这里找到：https://github.com/nyxgeek/simplescanners 2.10 版新特性： 远程 MySQL 数据库日志记录选项 -- 记录到远程数据库 PAUSEFILE -- 如果存在 pausefile...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

ChaosKobra

ChaosKobra 🐍 另一个面向普通用户的子域枚举工具，用 Python3 编写。 🔧 技术与工具 📚 要求 Python 3.9+ pip3 安装 请使用包管理器 pip 安装所需的依赖。如果尚未安装，请使用以下命令进行安装。 root@kitploit: sudo apt-get install python3-pip 建议在虚拟环境中安装 Python 依赖，为此请先安装 venv 包。 root@kitploit: python3 -m pip install venv python3 -m venv env source env/bin/activate 之后运行以下命令：...

CVE-2026-64761

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to identify what other apps a user has installed...

CVE-2026-12766

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-12765

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-12767

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

EUVD-2026-78129

This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed...

CVE-2026-84518

CVE-2026-84518 is an information disclosure vulnerability in Apple products affecting Safari, iOS, iPadOS, and macOS . The root cause is a flaw in state management , which allowed a malicious website to determine which apps a user has installed. The issue was addressed through improved state mana...