CVE-2023-27587-PoC

CVE-2023-27587-PoC Простое PoC для CVE-2023-27587 Что такое ReadToMyShoe? ReadtoMyShoe RTMS — это веб-приложение rust, yew и axum, которое позволяет загружать статьи по URL или через прямой ввод и слушать их позже. Воздействие Если при добавлении статьи возникает ошибка, веб-сайт показывает...

CVE-2022-20866

CVE-2022-20866용 RSA 키 검사기 Cisco Adaptive Security Appliance Software 및 Firepower Threat Defense Software를 실행하는 장치에서 RSA 키 처리의 취약점으로 인해 인증되지 않은 원격 공격자가 RSA 개인 키를 검색할 수 있습니다. 이 취약점은 하드웨어 기반 암호화를 수행하는 하드웨어 플랫폼의 메모리에 RSA 키가 저장될 때 로직 오류로 인해 발생합니다. 공격자는 대상 장치에 대해 Lenstra 부채널 공격을 사용하여 이 취약점을 악용할 수 있습니다...

CVE-2021-27850_POC

Эксплойт CVE-2021-27850 Обзор CVE-2021-27850 — это критическая уязвимость удалённого выполнения кода без аутентификации, обнаруженная во всех последних версиях Apache Tapestry. Загрузив файл AppModule.class, можно получить секретный ключ HMAC, используемый для подписи всех сериализованных объекто...

CVE-2021-27850_POC

Эксплойт CVE-2021-27850 Обзор CVE-2021-27850 — это критическая уязвимость удаленного выполнения кода без аутентификации, обнаруженная во всех последних версиях Apache Tapestry. Загрузив файл AppModule.class, мы можем раскрыть секретный ключ HMAC, используемый для подписи всех сериализованных...

CVE-2022-41544

CVE-2022-41544 Эксплойт-скрипт Этот репозиторий содержит скрипт для эксплуатации уязвимости CVE-2022-41544 в GetSimple CMS. Скрипт выполняет несколько шагов: проверяет наличие уязвимостей, извлекает ключи API, устанавливает cookies, получает CSRF-токены, загружает оболочку и запускает её. Изменен...

CVE-2026-27944

CVE-2026-27944 POC: Nginx UI 인증 우회 백업 다운로드 + 대시보드 접근 이 저장소는 Nginx UI 의 치명적인 취약점인 CVE-2026-27944 에 대한 향상된 개념 증명POC 익스플로잇을 포함하고 있습니다. 이 취약점은 인증되지 않은 공격자가 /api/backup 엔드포인트를 통해 시스템 백업을 다운로드할 수 있게 합니다. 또한, 애플리케이션은 X-Backup-Security HTTP 응답 헤더 내부에 AES-256 암호화 키와 IV를 노출하여, 공격자가 다운로드한 백업을 쉽게 복호화할 수 있게...

CVE-2023-34362

CVE-2023-34362: MOVEit Transfer Неавторизованное удаленное выполнение кода Полное техническое описание уязвимости и эксплуатации читайте в нашем анализе на AttackerKB. Использование root@kitploit: ruby CVE-2023-34362.rb Примечание: Гаджет десериализации настроен на запуск 'notepad.exe'. Пример...

PT-2026-82551

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

Astra Linux – Vulnerability in mbedtls

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS from 2.19.1 onwards does not reduce the blinded scalar before computing the inverse. This allows a local attacker to recover the private key through side-channel attacks...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

Linux Distros Unpatched Vulnerability : CVE-2026-72103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 md: port block device access to file accidentally...

CVE-2026-72049

A flaw was found in the Linux kernel's IEEE 802.15.4 LLSEC subsystem. A local user without special privileges could exploit ungated legacy dump operations to read raw 16-byte AES-128 keys from the kernel keytable on wireless personal area network WPAN devices. This information disclosure...

EUVD-2026-60117

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

CVE-2026-74799 SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...

CVE-2026-72049 ieee802154: admin-gate legacy LLSEC dump operations

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL with...

PT-2026-71754

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

EUVD-2026-57225

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-47232

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-48766

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...