cups-script-final-project

機能 CVE-2025-58060 は Common UNIX Printing System CUPS における認証バイパスの脆弱性です。このツールは二段階の検出を行います。バージョン番号だけに頼るのではなく、バナーに基づくバージョンチェックとアクティブな認証バイパスプローブを組み合わせます。これにより、Server ヘッダーがパッチバージョンを切り詰めている場合でも、実際の脆弱性ステータスを確認できます。 ステージ1 — バージョンチェック CUPS の Web インターフェース（ポート 631）から Server: HTTP...

CVE-2026-24468: Observable Response Discrepancy

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the syste...

CVE-2026-39364: Incorrect Behavior Order: Validate Before Canonicalize

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...

Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

!/usr/bin/env python """ Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution RCE Google Dork: N/A Date: 2023-04-13 Exploit Author: max / Zoltan Padanyi Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit Software Link:...

CVE-2021-41580

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Design/Logic Flaw

DISPUTED The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application...

CVE-2021-41580

CVE-2021-41580 affects the passport-oauth2 package prior to 1.6.1 for Node.js. The root issue is mishandling of the error condition when failing to obtain an access token, which can be exploited when an OAuth provider reports authentication failures with HTTP 200 and the application grants author...

CVE-2021-41580: Undefined Security Weakness

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Design/Logic Flaw

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC72301 as it returns a 200 instead of a 400...

SharePoint Workflows XOML Injection

This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality. Module Options msf use exploit/windows/http/sharepoint/workflowsxoml msf...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...

Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change (MSF)

No description provided by source. @Kc57 Symantec Web Gateway = 5.0.3.18 Arbitrary Password Change require 'msf/core' class Metasploit3 Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initializeinfo= superupdateinfoinfo, 'Name' = Symantec Web Gateway = 5.0.3.18 Arbitrary Password...