CVE-2025-65881

CVE-2025-65881 프로젝트 Zoo Management System v1.00은 /zms/classes/Login.php?f=login에서 크로스 사이트 스크립팅XSS에 취약합니다. 이유는 다음과 같습니다: 1. /zms/classes/Login.php?f=login에서 JSON 응답의 Content-type이 올바르지 않음 2. 응답 내 사용자 입력이 적절히 처리되지 않음 인증되지 않은 공격자가 피해자 브라우저에서 실행되는 악성 HTML/JS를 주입할 수 있습니다. 영향을 받는 파일 및 취약한 코드...

CVE-2026-44037

A flaw was found in dcmtk. An attacker can cause a Denial of Service DoS by providing a crafted DICOM Digital Imaging and Communications in Medicine JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memo...

EUVD-2026-95027

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

EUVD-2026-94988

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

CVE-2026-14999

The IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an authentication bypass. The root cause is the improper verification of cryptographic signatures , which allows a remote attacker to f...

CVE-2026-14999 IBM DataPower Gateway Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

CVE-2026-44037

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

CVE-2026-44037 Uncontrolled recursion in DCMTK JSON reader allows denial of service

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

CVE-2026-44037

The OFFIS DCMTK 3.7.0 library is vulnerable to a denial of service (stack exhaustion and process crash) due to uncontrolled mutual recursion between the functions DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement(), and DcmJSONReader::parseSequence() located in dcmdata/libsrc/dcjsonrd.cc...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 전문 JWT 보안 테스트 툴킷. JSON 웹 토큰을 분석, 크래킹, 위조 및 악용하며 15개 이상의 취약점 점검, 10만 개의 시크릿 워드리스트, CVE 특화 공격을 지원합니다. 기능 핵심 분석 JWT 디코딩 및 취약점 스캐닝 15개...

CVE-2026-107574

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...

CVE-2026-107275

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2016-4010

CVE-2016-4010 CVE-2016-4010 exploit.php を実行して JSON ペイロードを生成します exploit.py を、生成されたペイロードを triggervulnerabilitypayload に渡して実行します...

CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQLインジェクション ★ CVE-2026-30951 Sequelize ORM SQLインジェクション PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 概要 CVE-2026-30951 は、広く使用されている Node.js ORM である Sequelize v6 における SQLインジェクション の脆弱性です。 この脆弱性は JSON/JSONB の where...

28458

CVE-2020-28458 해당 패키지의 영향을 받는 버전은 Prototype Pollution에 취약합니다. datatables v1.10.16-1.10.16 사용법 Python 스크립트를 실행하고 필요한 입력값을 입력하십시오: Target URL Proxy URL 선택사항, 없으면 비워둠 Timeout 초 단위, 기본값 10 예시: python3 exploit.py 이 스크립트는 더 나은 출력을 위해 로깅을 사용하며, 가능한 경우 JSON 응답을 파싱하여 prototype pollution을 검사합니다...

json_cve_2020_10663

CVE-2020-10663（json gem の脆弱性）向け回避策 json gem にはセキュリティ上の脆弱性 CVE-2020-10663 があります。特定の JSON ドキュメントを解析すると、json gem は対象システム内に任意のオブジェクトを作成するよう強制される可能性があります。 ユーザーには、json 2.3.0 以降へのアップグレードを強くお勧めします。 json のバージョンをアップグレードできないユーザーのために、この gem（jsoncve202010663）は、お使いの json バージョンに CVE-2020-10663 対策のモンキーパッチを適用します。...

CVE-2026-107574 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...

EUVD-2026-94854

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...