CVE-2024-4577

PHP-CGI Windows 플랫폼 원격 코드 실행 취약점CVE-2024-4577 소개 PHP는 Hypertext Preprocessor하이퍼텍스트 전처리기의 약자로, 현재 널리 사용되는 오픈소스 스크립트 언어이며 웹 개발과 HTML 내장에 특히 적합하고 사용법이 매우 간단합니다. CGI는 영어로 Common Gateway Interface공용 게이트웨이 인터페이스라고 하며, Apache가 PHP 스크립트를 만나면 PHP 프로그램을 CGI 애플리케이션php-cgi.exe에 제출하여 해석하고, 해석된 결과를 Apache에 반환한...

CVE-2026-84939

A flaw was found in Apache FreeMarker. A remote attacker could exploit a path traversal vulnerability in the template loading mechanism by providing a specially crafted, malformed locale identifier. This is possible if the localized lookup configuration setting is enabled, which is the default...

CVE-2025-49132-Pterodactyl-Panel-RCE

CVE-2025-49132 — Pterodactyl 패널 보안 연구 및 교육 분석 개요 이 프로젝트는 Pterodactyl 패널에 영향을 미치는 취약점인 CVE-2025-49132 와 관련된 연구를 문서화합니다. 목적: 보안 연구, 교육, 방어 인식 통제된 환경에서만 사용 무단 악용을 권장하지 않습니다 취약점 요약 CVE ID: CVE-2025-49132 영향받는 제품: Pterodactyl 패널 영향: 원격 코드 실행 RCE 공격 벡터: 로케일 처리의 입력 검증 결함 영향 성공적으로 악용될 경우, 이 취약점은 다음을 허용할 ...

HTB-Pterodactyl-RCE-CVE-2025-49132

Pterodactyl Panel Locale RCE CVE-2025-49132 — 교육용 PoC -6f42c1 승인된 테스트 및 방어 학습 전용입니다. 이 저장소는 대상target을 소유했거나 테스트할명시적 서면 권한을 보유한 통제된 랩 환경예: CTF/HTB 스타일 환경을 위해 만들어졌습니다. 컨텍스트 이 저장소에는 v1.11.11 이전 버전의 Pterodactyl Panel 에 영향을 미치는 실제 취약점에 대한 교육용 Python PoCpterodactylrce.py가 포함되어 있습니다. 취약한 구성에서 인증되지 않은 공격...

keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Security Update

New Red Hat build of Keycloak 26.4.16 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

EUVD-2026-80830

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651

CVE-2026-79651 is an unauthenticated denial-of-service vulnerability in the keycloak-services component of Keycloak, specifically in its theme localization endpoints . The root cause is that the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-m...

CVE-2026-79651

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

POC-CVE-2024-38820

CVE-2024-38820 개념 증명 개요 이 프로젝트는 Spring Framework의 DataBinder에서 disallowedFields 보호를 우회할 수 있는, 로케일에 의존적인 대소문자 변환 문제로 인한 취약점인 CVE-2024-38820 을 시연합니다. 취약점 세부 정보 CVE ID : CVE-2024-38820 영향을 받는 구성 요소 : Spring Framework DataBinder 근본 원인 : String.toLowerCase 동작이 로케일에 따라 달라짐 영향 : 필드 보호 우회, 잠재적 권한 상승 문제점...

CVE-2025-49132

CVE-2025-49132 개념 증명PoC 이 저장소는 Pterodactyl Panel 버전 1.11.11 이전에서 발생하는 중요 인증되지 않은 원격 코드 실행RCE 취약점인 CVE-2025-49132에 대한 개념 증명PoC을 포함합니다. 취약점 상세 정보 CVE ID : CVE-2025-49132 심각도 : 10.0 치명적 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 영향받는 버전 : 1.11.11 예: 1.9.0 1.11.10 설명 : Pterodactyl Panel의...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

EUVD-2026-78277

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...