18583 matches found
CVE-2026-58457
CVE-2026-58457 - Shenzhen Aitemi M300 Wi-Fi 리피터에서 인증되지 않은 OS 명령 주입 !WARNING 이 코드는 교육 및 연구 목적으로만 있는 그대로 제공됩니다. 이 PoC를 프로덕션 시스템, 공유 환경 또는 승인되지 않은 대상에서 사용하지 마십시오. 이 코드를 실행하거나 호스팅하면 오용 시 안티바이러스 탐지, 보안 모니터링 경고 또는 법적 결과를 초래할 수 있습니다. 저자 및 저장소 관리자는 이 코드로 인한 손해, 오용 또는 불법 활동에 대해 책임을 지지 않습니다. 격리된 실험실 환경에서 적...
EUVD-2026-88581
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...
CVE-2026-74251
Phoca Cart의 속성 필터를 통한 비인증 SQL 인젝션 Phoca Cart ≤ 6.1.6 — 비인증 공격자가 시간 기반 블라인드 인젝션으로 전체 데이터베이스 추출 요약 Phoca Cart의 공개 상점 아이템 페이지에서 a속성 및 s사양 GET 배열 매개변수가 파라미터화나 이스케이프 없이 SQL WHERE 절에 원시 형태로 연결됩니다. 비인증 공격자는 이러한 매개변수를 통해 임의의 SQL을 주입할 수 있으며, 시간 기반 블라인드 기법으로 전체 데이터베이스를 추출할 수 있습니다. 취약점은...
CVE-2026-79538
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...
CVE-2026-79538
The metatool-ai MetaMCP software, specifically version 2.4.22 and below, is vulnerable to Code Execution . This vulnerability exists in the internal MCP inspector proxy endpoint at GET /mcp-proxy/server/stdio. The root cause is located within the createTransport function in the STDIO branch , spe...
CVE-2026-79538: Improper Control of Generation of Code
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...
CVE-2026-79538
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...
CVE-2026-79348
KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...
CVE-2026-79348
KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...
CVE-2026-79348
KitchenAsty versions up to and including 0.3.0 is vulnerable to a broken object level authorization (IDOR) flaw in the reservations API. Specifically, the GET /api/reservations/:id endpoint in packages/server fails to perform ownership or role checks. The getReservation handler in packages/server...
EUVD-2026-89360
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...
CVE-2026-79348: Authorization Bypass Through User-Controlled Key
KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...
EUVD-2026-89425
KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...
CVE-2026-79348
KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...
PT-2026-102820
Name of the Vulnerable Software and Affected Versions metatool-ai MetaMCP versions 2.4.22 and earlier Description An insecure direct object reference IDOR exists in the MCP transport session dispatch. The session store, specifically the getSession function in session-lifetime-manager.ts, relies...
SUSE CVE-2026-61837
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...
CVE-2018-6574
CVE-2018-6574 CVE-2018-6574 go get RCE...
CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...