CVE-2026-50607

CVE-2026-50607 affects the Acer System Monitoring component bundled with NitroSense and PredatorSense . A WebSocket service was configured to listen on all network interfaces rather than a restricted one, which may expose the service to unintended network access. The CVSS 4.0 base score is 6.9 (M...

CVE-2026-50607 WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access...

CVE-2026-23918-Passive-Audit

CVE-2026-23918 감사 스크립트 대안으로 curl을 사용해 헤더를 가져와서 살짝 들여다볼 수도 있지만, 여기에 더 나은 방법이 있습니다: Apache HTTP Server를 위한 비침습적 HTTP 메타데이터 감사 도구 CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 노출 분류. 이 도구는 일반 HTTP HEAD/GET 요청을 보내고 TLS ALPN 협상을 수행하여 HTTP/2 지원 여부를 관찰합니다. 요구 사항 Python 3.13 이상...

node-vulnerable

node-vulnerable 이 저장소는 Endor Labs EXPOSURE용 합성 데모 타깃 입니다. 현재 상태는 의도적으로 악용 가능한 상태입니다. EXPOSURE는 이에 대해 악용 가능 판정을 보고합니다. 추적 중인 CVE: CVE-2018-21268 — host 인수를 통한 traceroute 명령 주입. 이 기준선에서는 악용 가능입력 검증 없음. 업스트림 수정 없음. CVE-2018-3757 — 파일 경로 인수를 통한 pdf-image 명령 주입. 이 기준선에서는 악용 불가/render 라우트가 PDFImage를 생성...

CVE-2026-44940

CVE-2026-44940 affects the rancher-extension-stackstate extension in SUSE Observability . The root cause is the exposure of service tokens in plain configuration or insecure locations , rather than storing them in a secure secret management mechanism. An attacker with minimal access (low privileg...

CVE-2025-32421

CVE-2025-32421 Eclipse 기술 연구소 CVE-2025-32421 Eclipse 기법의 포괄적인 시연 - 원래 CVE-2024-46982 패치를 우회하는 Next.js 15.0.4에 대한 정교한 경쟁 조건 공격입니다. 경고 - 교육 목적으로만 사용 이 연구소는 다음 용도로만 설계되었습니다: 보안 연구 및 교육 취약점 평가 훈련 공격 벡터 이해 보안 인식 개발 사용 금지: 소유하지 않은 시스템에 대한 무단 테스트 악의적인 공격 또는 악용 프로덕션 환경 Eclipse 기법 개요 Eclipse 기법은 Next.js...

django-cve-2025-64459

Django CVE-2025-64459 이 애플리케이션은 여러 Django 버전에 영향을 미치는 CVE-2025-64459를 시연합니다. 이 취약점은 최신 Django 릴리스에서 패치되었습니다. SQL 인젝션 SQL 인젝션은 사용자 입력이 SQL 쿼리의 일부로 처리되어 공격자가 쿼리 작동 방식을 변경하고 접근해서는 안 되는 데이터를 노출하거나 수정할 수 있는 취약점입니다. 취약점 설명 Django QuerySet 및 Q 객체에서 데이터 노출로 이어질 수 있는 SQL 인젝션 취약점입니다. 이 익스플로잇은 Django...

INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion

INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 is vulnerable to information disclosure, allowing unauthenticated attackers to access sensitive device information and configuration data via a direct request to the /cgi-bin/exportsettings.sh endpoint. id: CVE-2020-24285 info: name: INTELBRAS...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

Razvan Stanga Varnish/Nginx Proxy Caching = 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests. id: CVE-2025-62126 info: name:...

Citrix NetScaler Memory Disclosure - CitrixBleed 2

Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway id: CVE-2025-5777 info: name: Citrix NetScaler Memory Disclosure - CitrixBleed 2 author: watchtowr,DhiyaneshDk,darses severity: critical description: | Insufficient...

Avada < 7.11.7 - Information Disclosure

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with ...

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

Mitel MiCollab <= 9.8.0.33 - SQL Injection

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure

A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is...

TeamPass 2.1.27.36 - Improper Authentication

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-12478 info...

Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. id:...

Modoboa < 2.1.0 - Improper Authorization

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. id: CVE-2023-2227 info: name: Modoboa 2.1.0 - Improper Authorization author: ritikchaddha,princechaddha severity: critical description: | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. impact:...