129 matches found
CVE-2019-6340
CVE-2019-6340 教育目的のみ 実行 $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 エクスプロイト GET $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...
CVE-2018-20718
CVE-2018-20718 이것은 CVE-2018-20718에 대한 POC입니다. PHP 객체 주입 취약점입니다. 이 취약점은 8.2.1 이전의 모든 Pydio 버전에 영향을 미치며 인증되지 않은 원격 코드 실행으로 이어집니다. 원래 RIPS에 의해 발견되었습니다. 저는 Pydio\Core\Controller\ShutdownScheduler에서 가젯을 발견했는데, 이미 알려진 GuzzleHttp\Psr7\FnStream 가젯과 결합하면 원격 코드 실행이 가능합니다. 공격 예시 기술적 세부 사항...
CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CVE-2026-78175: Deserialization of Untrusted Data
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...
CLSA-2026-1788433786 TuxCare security update for guzzlehttp/guzzle (11 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 11 CVEs. Fixed in 6.0.2-p5+tuxcare...
CLSA-2026-1788333194 TuxCare security update for guzzlehttp/psr7 (1 CVE)
TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare...
CLSA-2026-1788269522 TuxCare security update for guzzlehttp/guzzle (7 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 7 CVEs. Fixed in 6.3.3-p3+tuxcare...
CVE-2026-67355
A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a...
CVE-2026-67339
A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...
CVE-2026-67354
A flaw was found in guzzlehttp/guzzle. This vulnerability, located in the RedirectMiddleware, can lead to information disclosure. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from a referring request into the generated...
CVE-2026-67353
A flaw was found in guzzlehttp/guzzle. A remote attacker can exploit this vulnerability by sending an excessive number of large 'Set-Cookie' header fields from a malicious server. This causes the application's CookieJar to store an unbounded amount of data in memory, leading to resource exhaustio...
CLSA-2026-1787819618 TuxCare security update for guzzlehttp/guzzle (3 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 3 CVEs. Fixed in 6.5.8-p3+tuxcare...
CLSA-2026-1786546010 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...
CLSA-2026-1786527009 TuxCare security update for guzzlehttp/psr7 (5 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...
PT-2026-80103
TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...
PT-2026-80120
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...
PT-2026-80074
TuxCare rebuilt guzzlehttp/guzzle to address 6 CVEs. Fixed in 6.3.3-p2+tuxcare...
CLSA-2026-1786346242 TuxCare security update for guzzlehttp/psr7 (1 CVE)
TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...