841650 matches found
CVE-2026-90577
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The...
CVE-2026-90576
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The explo...
UBUNTU-CVE-2026-90577
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The...
CVE-2025-3639
CVE-2025-3639 PoC - Liferay Portal/DXP ログインバイパス このリポジトリには、CVE-2025-3639 の Proof of Concept PoC が含まれています。これは、Liferay Portal（バージョン 7.3.0 ～ 7.4.3.132）および Liferay DXP（2024.Q1 から 2025.Q1.6 までの複数バージョン）におけるログインバイパス脆弱性です。この PoC は、有効な認証情報を持つ未認証ユーザーが、POST リクエストを GET リクエストに変更することで多要素認証 MFA...
EUVD-2026-77070
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580
FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2023-43208-PoC
Mirth Connect RCE Exploit CVE-2023-43208 Este script es una Prueba de Concepto PoC para la vulnerabilidad de Ejecución Remota de Código RCE en Mirth Connect versiones anteriores a la 4.4.1. Explota una vulnerabilidad de deserialización de XStream a través de la API. Requisitos Python 3.10 o...
lab-cve-2025-57819
（正在开发中）FreePBX CVE-2025-57819 实验室 - 未经认证的SQL注入到RCE链（Nuclei POC） 创建一个可重现的 FreePBX 15 实验室（Docker），用于验证 CVE-2025-57819——这是一个在 userman AJAX 端点中存在的严重未认证 SQL 注入漏洞，可被链式利用实现 RCE。包含一个可运行的 Nuclei 模板（基于行为而非版本检查）以及一个便于调试的测试工具。 亮点 在 userman 端点上的未认证时间盲注 SQL 注入 POC（SLEEP） 极简 Docker Compose（MariaDB + FreePBX 15）...
Exploit-for-CVE-2025-2304
Exploit-for-CVE-2025-2304 usage: exploit.py -h --url URL --username USERNAME --password PASSWORD 描述 Camaleon CMS 由于不安全的批量赋值存在权限提升漏洞。UsersController 中的 updatedajax 方法使用了 permit! 函数，允许处理未经过滤的参数。已认证的攻击者可利用此漏洞修改受限属性，从而获得提升的权限。 ⚠️ 此漏洞利用程序仅用于教育和研究目的。...
SAPGateBreaker-Exploit
CVE-2022-22536: SAPのフロントドアを通じたHTTPスマグリング SAP NetWeaver Application Server ABAP、SAP NetWeaver Application Server Java、ABAP Platform、SAP Content Server 7.53、SAP Web...
CVE-2011-2523-exploit
CVE-2011-2523 エクスプロイト vsFTPd 2.3.4 バックドア このプロジェクトは、vsFTPd 2.3.4 のバックドア脆弱性 CVE-2011-2523 を Python と pwntools を使用して悪用する方法を示しています。 免責事項: このプロジェクトは教育目的および許可されたペネトレーションテストの目的のみで使用してください。許可なくシステムに対して使用しないでください。 脆弱性の概要 CVE ID: CVE-2011-2523 影響を受けるソフトウェア: vsFTPd 2.3.4 タイプ: バックドア / リモートコマンド実行 ポート: 21 FTP,...
CVE-2026-90579 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...
CVE-2026-90579 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...
CVE-2026-90579
CVE-2026-90579 affects Cheshire Cat AI up to version 1.9.2 . The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id argument leads to missing authentication . An unauthenticated remote attacker can exploit this over t...
CVE-2026-90579 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...
EUVD-2026-77064
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...