poc-graphql

目次 目次 GraphQLの研究 目的 ラボ Dockerへのデプロイ セキュリティの弱点 認可 問題点 推奨事項 インジェクション 問題点 推奨事項 リソース枯渇 問題点 推奨事項 プライベートデータの露出 問題点 推奨事項 予期しないエラー時における技術情報の露出 問題点 推奨事項 安全でないダイレクトオブジェクト参照 問題点 APIの誤ったクライアント範囲への露出 問題点 サブスクリプションWebSocketエンドポイントのデフォルト有効化 クロスオリジンリソース共有のデフォルト有効化 推奨事項 発見クエリ 使用した参考文献...

Joomla-3.10.12-languagehelper-hotfix

このリポジトリは非推奨です。代わりにこちらを使用してください：https://github.com/TLWebdesign/Joomla-3-EOL-Security-Fixes Joomla-3.10.12 LanguageHelper.php Hotfix この小さなプラグインは、Joomla...

PT-2026-90507

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

PT-2026-90501

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

PT-2026-90514

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

Linux Distros Unpatched Vulnerability : CVE-2026-88030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

PT-2026-90358

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache isize extended in cifs setsize when extending cifs setsize calls truncate pagecache but skips pagecache isize extended on extension. truncate setsize shows the correct pattern: i size writeinode, newsize; if...

WordPress Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin <= 1.7.1066 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by TarPeg007 in WordPress Plugin Royal Elementor Addons versions = 1.7.1066...

PT-2026-90407

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...

EUVD-2026-76190

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

Linux Distros Unpatched Vulnerability : CVE-2026-88013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attache...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

CVE-2025-51471-POC

CVE-2025-51471 - Ollama 跨域令牌泄露 PoC 作者： ajtazer 🔥 概述 此仓库包含 CVE-2025-51471 的概念验证（PoC），这是一个影响 所有 Ollama 版本 （包括最新版本）的跨域认证令牌泄露漏洞。 📋 漏洞描述 当 Ollama 从返回 401 Unauthorized 的 HTTPS 服务器拉取模型时，它会跟随 WWW-Authenticate 头中的 realm URL，而 不验证其是否属于同一域... 这允许攻击者： 1. 搭建一个恶意的“registry”服务器 2. 诱骗用户从该服务器拉取模型 3...

CVE-2026-81941 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

autopwn

autopwn 指定目标并针对它们运行工具集 autopwn 旨在让渗透测试人员的工作更轻松、更一致，允许他们指定想要针对目标运行的工具，而无需在 shell 中输入它们或编写脚本。这个工具在某些考试中可能也会派上用场。 安装 建议您使用 Docker 镜像，并暴露 TCP 5000 端口供 autopwn 客户端连接。这是因为 autopwn Docker 镜像已经配置完成（工具已安装并放置在正确的位置）。 只允许此软件包在回环 IP 地址上监听。如果您让此软件包监听公共 IP，就等于允许任意用户以 root 身份在您的服务器上执行命令。最终将需要 HTTPS...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise 密码重置账户接管（ATO） 仅供研究和测试使用！如果此工具未按预期使用，我对生产基础设施造成的任何损害概不负责。仅可在您拥有或获准测试的系统上使用！ 用法 root@kitploit: usage: CVE-2025-58434-PasswordResetNew.py -h -u URL -e EMAIL -p PASSWORD Flowise Password Reset Exploit ATO options: -h, --help show this help message and exit -u, --url URL Base URL of the Flowis...

PwnCity

PwnCity 一个配置不安全的 TeamCity 持续集成环境。 进行中： 部署代码 即将 最终推出。 演示 通过 PwnCity 的路径可能不止一条，但以下是我将在 2 月 24 日 OWASP Sacramento Chapter 会议上演示的那条路径。 注意： 这里在很大程度上忽略了操作安全，因为这只是一个演示。 初始访问 1. 扫描 IP 以发现 SSH 和 TeamCity：nmap -Pn -p- 52.234.0.18。 注意：它不会响应 ICMP，因此 nmap 52.234.0.18 会让人误以为主机已死。 注意：如果只扫描前 1000 个 TCP 端口，就会错过...

CVE-2025-55182-scanner

🔍 CVE-2025-55182-scanner - 轻松检测漏洞 Download CVE-2025-55182-scanner 🚀 快速开始 欢迎！本指南将帮助您下载并运行 CVE-2025-55182-scanner。该工具可以非侵入式地识别应用程序中暴露的 React Server Components 端点。 🔧 系统要求 开始之前，请确保您具备以下条件： 操作系统： Windows 10 或更高版本、macOS 或 Linux 发行版。 磁盘空间： 至少 100 MB 可用空间。 网络： 需要互联网连接以获取更新和下载。 📥 下载与安装 要下载扫描器，请访问以下页面： 下载...