nextjs-auth-bypass

nextjs-auth-bypass 针对 Next.js 授权绕过漏洞（CVE-2025-29927）的分析与利用 Next.js 授权绕过 – CVE 分析 概述 本项目演示了 Next.js 应用中因中间件验证不当而导致的授权绕过漏洞。 漏洞详情 Type: 授权绕过 CVE: CVE-2025-29927 Severity: 严重 CVSS 9.1 使用的工具 Burp Suite Kali Linux Firefox 利用摘要 使用 Burp Suite 拦截 HTTP 请求 修改请求头以绕过身份验证 获得对管理后台的未授权访问 根本原因...

CVE-2024-52528 Auth Token can be passed dummy or wrong the middleware response is 200 OK

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2...

Cachet vulnerable to forced reinstall

Impact Authenticated users, regardless of their privileges User or Admin, can trick Cachet and install the instance again, leading to arbitrary code execution on the server. Patches This issue was addressed by improving the middleware ReadyForUse, which now performs a stricter validation of the...

CVE-2018-3717

connect node module before 2.14.0 suffers from a Cross-Site Scripting XSS vulnerability due to a lack of validation of file in directory.js middleware...