CVE-2025-29927-NextJs-Middleware-Simulation

CVE-2025-29927: محاكاة تجاوز التحقق من صلاحيات Middleware في Next.js يستعرض هذا المستودع استغلال ثغرة CVE-2025-29927 ، وهي ثغرة حرجة في Next.js تسمح للمهاجمين بتجاوز عمليات التحقق من الصلاحيات المعتمدة على Middleware. ينبع الخلل من المعالجة غير السليمة لترويسة HTTP الداخلية x-middleware-subreques...

puma_header_normalization-CVE-2024-45614

التحقق من Puma Header normalization CVE-2024-45614 النشرة الأمنية: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 commit الإصلاح: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043 النتائج نتائج تشغيل request.rb duplicate الهدف| النتيجة ---|---...

kernel: ipv6: exthdrs: refresh nh after handling HAO option

A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option HAO, the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value TLV options,...

CVE-2025-25257

اختبار ثغرة CVE-2025-25257 في Fortinet FortiWeb الوصف تم تصميم هذا السكربت PowerShell لأغراض اختبار الاختراق المصرح به فقط. يختبر أجهزة Fortinet FortiWeb بحثًا عن CVE-2025-25257، وهي ثغرة حقن SQL غير مصادق عليها في نقطة النهاية /api/fabric/device/status. يقوم السكربت بما يلي: يتجاهل أخطاء شهادات...

cve-2017-7269-tool

cve-2017-7269 أداة webshell و shellcode البناء csc cve-2017-7269.cs الاستخدام CVE-2017-7269 parms Header: -h set host for If header -p set port for If header -s set scheme for If header -l length of physical path WebShell: -w upload webshell to server -wp path of webshell to save ShellCode: -c...

CVE-2026-106452

A flaw was found in lz4-java. A remote attacker can trigger a Denial of Service DoS by providing a crafted compressed data stream with an oversized block header. During decompression, the input stream allocates memory based on this attacker-controlled size field before reading the actual payload,...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 حقن ترويسة بدون مصادقة يمنح وكيل الذكاء الاصطناعي وصولاً غير مقيّد إلى نظام ملفات المضيف نظرة عامة تم الإبلاغ عن ثغرة تفويض غير سليم وانتحال ترويسة header spoofing تتعلق بالوكيل العكسي reverse proxy الخاص بـ Knowns لخدمة daemon وكيل OpenCode AI المدمج...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 و CVE-2025-61884 تحرير: كشفت Oracle للتو عن ثغرة أمنية جديدة CVE-2025-61884، يمكن العثور على سكريبت الكشف عن هذه الثغرة في هذا المستودع أو أصلاً هنا:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. كما ورد في تنبيه Oracle الأمني: يعالج هذا التنبيه الأمني الثغرة...

react-cve-2025-55182-lab

الإعداد: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab الاستغلال: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...

CVE-2026-105324

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

EUVD-2026-94153

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

CVE-2026-105324

An HTTP header injection vulnerability exists in the start-page-loader.cgi component of ADM . This flaw allows an unauthenticated remote attacker to read arbitrary files on the host system by sending a crafted HTTP request with injected headers via the state parameter . The attacker can exploit t...

CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

CVE-2026-92414: Session Fixation

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

PT-2026-107335

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

SUSE SLES15 Security Update : kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:4531-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4531-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed:...

CVE-2026-80048

A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...

CVE-2025-9816

CVE-2025-9816 XSS مخزّن على إضافة WP-Statistics الماسح الضوئي الكشف وإثبات المفهوم "إضافة WP Statistics – الإضافة التحليلية الأكثر شعبية والصديقة للخصوصية في WordPress – عرضة لثغرة Cross-Site Scripting المخزّنة عبر ترويسة User-Agent في جميع الإصدارات حتى 14.5.4 وما يشملها، وذلك بسبب عدم كفاية تعق...

CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...