CVE-2024-23222-Coruna-Exploit-Kit-Deobfuscated

🏴‍☠️ Coruna iOS Exploit Kit: CVE-2024-23222 연구 📌 개요 이 저장소는 Coruna iOS Exploit Kit 에 대한 포괄적인 기술 분석 및 디난독화 연구를 포함합니다. 이 연구는 익스플로잇 체인이 CVE-2024-23222 — WebKit의 JavaScriptCoreJSC 엔진에서 원격 코드 실행RCE을 달성하기 위해 사용되는 높은 심각도의 타입 혼란 취약점 — 을 어떻게 대상으로 하는지 문서화하는 데 초점을 맞춥니다. 🔗 참고 자료 및 크레딧 취약점 출처 : Sploitus -...

CVE-2025-25460

FlatPress CMS の格納型XSS v1.3.1 CVE-2025-25460 著者: Athul S 説明 FlatPress 1.3.1 の「エントリ追加」機能において、格納型クロスサイトスクリプティング XSS の脆弱性が確認されました。この脆弱性により、認証された攻撃者 がブログ記事に悪意のあるJavaScriptペイロードを注入でき、他のユーザーが記事を閲覧した際にペイロードが実行されます。問題は、ブログエントリ送信フォームの 「テキストエリア」フィールド に対する不適切な入力サニタイズ に起因します。 攻撃ベクトル 認証された攻撃者 がブログ記事のエントリに悪意のある...

CVE-2025-65675

CVE-2025-65675 Classroomio LMS 0.1.13における格納型クロスサイトスクリプティング（XSS）の脆弱性。認証された攻撃者が細工されたSVGプロフィール画像を介して任意のコードを実行できる可能性があります。発見者 - Rivek Raj Tamang（RivuDon）、インド、シッキム州。 影響を受ける製品: ClassroomIO 影響を受けるバージョン: 0.1.13 発見者: Rivek Raj Tamang（RivuDon）、インド、シッキム州 脆弱性の詳細 格納型クロスサイトスクリプティング 概要 Classroomio LMS バージョン...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-77923

Dolibarr versions 21.0.0 through 24.0.0 (exclusive) contain an authorization bypass in the clonetasks mass action handler (htdocs/core/actions_massactions.inc.php). An inverted boolean condition (!in_array()) in the private-project membership check allows any authenticated user with project creat...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

EUVD-2026-65087

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

GHSA-XM98-3VCF-FPH7 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

CVE-2026-71509

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71509

Dolibarr versions before 24.0.0 contain an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated users holding only expense-creation rights can directly set approval status and approver identity fields via the API, effectively bypassing the approval wo...

EUVD-2026-65082

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2024-50490

CVE-2024-50490 PegaPoll = 1.0.2 - 인증되지 않은 임의 옵션 업데이트 설명: WordPress용 PegaPoll 플러그인은 1.0.2 버전까지 권한 확인이 누락되어 권한 상승으로 이어질 수 있는 데이터 무단 수정에 취약합니다. 이를 통해 인증되지 않은 공격자가 WordPress 사이트의 임의 옵션을 업데이트할 수 있습니다. 이는 관리자 등록 기본 역할을 업데이트하고 사용자 등록을 활성화하여 공격자가 취약한 사이트에 대한 관리자 사용자 액세스 권한을 얻도록 악용될 수 있습니다. root@kitploit:...

CVE-2024-50485

CVE-2024-50485 Exam Matrix = 1.5 - 認証なし権限昇格 説明: Exam Matrix WordPress プラグインは、バージョン 1.5 までの全バージョンにおいて権限昇格の脆弱性があります。これは、プラグインが認証されていないユーザーがより高い権限ロールとして登録できるようにする機能を適切に制限していないためです。そのため、認証されていない攻撃者が管理者などの高いアクセス権限を取得する可能性があります。 root@kitploit: Published: 2024-10-25 00:00:00 CVE: CVE-2024-50485 CVSS:...

CVE-2024-50482

CVE-2024-50482 Woocommerce Product Design = 1.0.0 - 인증되지 않은 임의 파일 업로드 설명: Woocommerce Product Design 플러그인은 WordPress에서 사용되며, 1.0.0까지의 모든 버전에서 파일 유형 검증이 누락되어 임의 파일 업로드에 취약합니다. 이로 인해 인증되지 않은 공격자가 영향받은 사이트 서버에 임의 파일을 업로드할 수 있으며, 이는 원격 코드 실행으로 이어질 수 있습니다. root@kitploit: Published: 2024-10-25 00:00:00...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503

Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...