CVE-2020-4463

IBM Maximo Asset Management は、XXE 脆弱性 CVE-2020-4463 による情報漏えいに対して脆弱です IBM Maximo Asset Management は、XML データを処理する際に XML 外部エンティティインジェクション XXE 攻撃に対して脆弱です。リモートの攻撃者がこの脆弱性を悪用して、機密情報を公開したり、メモリリソースを消費させたりする可能性があります。 基本スコア: 8.2 ベクター: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L 影響を受けるコアコンポーネント IBM Maximo...

CVE-2023-49496_PoC

CVE-2023-49496PoC 설명 UCServer는 고급 융합 통신 서버입니다. 上海澍品信息科技有限公司의 UCServer에 SQL 삽입 취약점이 존재하며, 공격자는 이 취약점을 이용하여 데이터베이스의 민감한 정보를 획득할 수 있습니다. POC POST /login/wwxcorpInfo/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded Accept: application/json, text/javascript, /; q=0.01 X-Requested-With:...

CVE-2022-31269

CVE-2022-31269 Nortek Control Linear eMerge E3-Series 정보 유출 선택적 인수: -h, --help 도움말 메시지를 표시하고 종료 -u url, --url url 대상 URL 예: "http://127.0.0.1" -f file, --file file 파일 내 대상 예: "ip.txt" 사용법 python3 CVE-2022-31269.py -u http://127.0.0.1 python3 CVE-2022-31269.py -f ip.txt 링크...

CVE-2026-107634

Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset and getnextdatum that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted,...

EUVD-2026-95021

Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset and getnextdatum that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted,...

CVE-2026-105828

Parse Server versions 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 are vulnerable to an information disclosure vulnerability via GraphQL errors. Even when public introspection is disabled, unauthenticated attackers possessing a public Application Id can send crafted operations to trigger ...

EUVD-2026-95015

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

CVE-2026-105828 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

CVE-2026-105828 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

CVE-2026-105823

The ImageMagick library is vulnerable in versions before 6.9.13-56 and 7.x before 7.1.2-31 due to a missing security-policy check in the CUT encoder . An attacker can supply specially crafted input to bypass configured security policies, which may result in the disclosure of sensitive information...

CVE-2024-24919

CVE-2024-24919 Checkpoint Firewall VPN에서 CVE-2024-24919 취약점을 검증하는 익스플로잇 도구 이 도구는 "Target-IP.txt" 파일이 포함된 출력 폴더를 생성합니다. 이 파일에는 영향을 받은 대상의 /etc/passwd 파일 내용이 포함되어 있으며, 이를 통해 시스템이 취약한지 여부를 확인할 수 있습니다. 이 도구를 실행하려면 Python 3만 있으면 됩니다. 도구를 실행하려면 다음 명령어를 사용하세요: python3 CVE-2024-24919.py -i Target-IP 취약점에...

CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

CVE-2025-12139: Integrate Google Drive 워드프레스 플러그인 - 정보 노출 익스플로잇 설명 이것은 CVE-2025-12139 에 대한 Golang 개념 증명PoC 익스플로잇입니다. 이 취약점은 워드프레스용 Integrate Google Drive 플러그인버전 = 1.5.3에 존재합니다. 인증되지 않은 공격자가 Google 클라이언트 ID, 클라이언트 시크릿 및 OAuth 액세스 토큰 을 포함한 민감한 정보를 검색할 수 있어 잠재적으로 전체 Google Drive 계정 탈취로 이어질 수 있습니다. 취...

CVE-2022-44268

CVE-2022-44268 ImageMagick 7.1.0-49 情報漏洩に対して脆弱 使用法 exploit.sh sh exploit.sh 出力画像は output.png に保存されます getdata.sh sh getdata.sh 出典 https://www.metabaseq.com/threat/imagemagick-zero-days/...

EUVD-2026-94999

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization...

CVE-2026-14273 IBM DataPower Gateway Incorrect Authorization

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization...

CVE-2026-14273 IBM DataPower Gateway Incorrect Authorization

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization...

CVE-2026-14273

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an incorrect authorization flaw (CWE-863). This issue could allow a local attacker to obtain sensitive information . No specific root cause...

CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - PoC 기능적 MongoDB 메모리 누수 익스플로잇 - 시뮬레이션된 R6 공격 CVE-2025-14847 MongoBleed에 대한 완전한 개념 증명 테스트됨: ✅ MongoDB 7.0.5 | 14,300+ 성공적 익스플로잇 | 4개의 UUID 유출 🎯 프로젝트 개요 이 저장소는 MongoBleed 로 알려진 CVE-2025-14847 취약점에 대한 완전히 작동하는 개념 증명PoC 을 포함합니다. 이는 MongoDB의 인증 전 힙 메모리 누수 치명적 결함입니다. 맥락:...

EUVD-2026-94994

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free...

CVE-2026-14508 IBM DataPower Gateway Use After Free

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free...