nanwinata-CVE-2024-52301

Laravel CVE-2025-27515 漏洞扫描器 此脚本使用简单工具 subfinder、httpx。 Laravel 是一个 Web 应用程序框架。当 registerargcargv PHP 指令设置为 on 时，用户调用任何带有特殊构造查询字符串的 URL，即可更改框架在处理请求时所使用的环境。该漏洞已在 6.20.45、7.30.7、8.83.28、9.52.17、10.48.23 和 11.31.0 版本中修复。该框架现在会在非 CLI SAPI 上忽略用于环境检测的 argv 值。...

CVE-2024-52301

CVE-2024-52301 POC 此漏洞基于 CVE-2024-50340 漏洞 要求 必须在 PHP 配置文件（php.ini）中启用 registerargcargv 选项。此设置会将命令行参数和查询参数加载到 $SERVER'argv' 中。 https://www.php.net/manual/en/ini.core.phpini.register-argc-argv 漏洞代码解析 //Illuminate\Foundation\Application public function detectEnvironment Closure $callback $args =...

cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

CVE-2026-12505

CVE-2026-12505 concerns the cifs-utils package. The issue: the root-owned cifs.upcall fails to securely drop root privileges before consulting user information, allowing a local, low-privilege attacker to craft a request_key payload that causes the process to enter a controlled environment with a...

Cloud Files Security Review Tool

This code performs a defensive security assessment of Windows systems by reviewing configuration elements associated with Cloud Files components, environment manipulation opportunities, temporary file exposure, and Windows Error Reporting artifacts...

Malicious code in motion-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f13ebafd858996faf32f6987cd969b933bf5c31c7ac329cf55f160bb6bbf6007 This package masquerades as the pino logger README copied from pino, exports module.exports.pino = middleware but its middleware does no logging. Whe...

CVE-2026-6130 chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection

A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the component Model Context Protocol Server Management System. Executing a manipulation of the argument args/env can lead to os command...

Permissive List of Allowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Permissive List of Allowed Inputs through incomplete sanitization of host environment variables in the host-env-security-policy.json and host-env-security.ts components. An attacker can...

CVE-2026-3315

Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33...

EUVD-2026-9101

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2...

CVE-2026-2844

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2...

CVE-2026-2844: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2...

PT-2026-22466

Name of the Vulnerable Software and Affected Versions Microchip TimePictra versions 11.0 through 11.3 SP2 Description A missing authentication check for a critical function exists in Microchip TimePictra, potentially allowing for configuration and environment manipulation. Recommendations Version...

CVE-2025-12852

DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device...

CVE-2025-12852

DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device...

EUVD-2025-198129

DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device...

EUVD-2024-2612

Malicious code in bioql PyPI...

EUVD-2024-17036

Malicious code in bioql PyPI...

CVE-2024-52301

Laravel is a web application framework. When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28,...

CVE-2024-50340

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...