cve-2025-29927-nextjs

Panel de administración de Himalaya Tech — Demo de CVE-2025-29927 ADVERTENCIA: Esta aplicación es intencionalmente vulnerable. Solo para fines educativos y de investigación de seguridad autorizada. No la implementes en un servidor público. Acerca de esta demo Esta aplicación demuestra...

CVE-2025-29927

CVE-2025-29927 — Next.js bypass de autorización en middleware Brevemente: vulnerabilidad en el middleware de Next.js que permite eludir las comprobaciones de autorización mediante la falsificación del encabezado x-middleware-subrequest. Contenido CVE-2025-29927 — Next.js bypass de autorización en...

Security Bulletin: Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System

Summary Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System CVE-2026-41683, CVE-2026-41690, CVE-2026-42353. Vulnerability Details CVEID:CVE-2026-41683 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify an...

CTF-Web-Exploitation

下界传送门失步 HUUP "我并非行走于既定道路，而是自由跃迁于虚空。若将我打包错误，我会将秘密送往错误的门槛。" 描述 该挑战展示了一个基于 UDP 的 HTTP/3 QUIC 应用层程序。由于 UDP 是无状态的，且代理不像 TCP 那样强制执行严格的 HTTP 请求边界，因此可能导致代理与后端服务器之间失步。攻击者可以在一个请求内部隐藏另一个 HTTP 请求。 注意：最大消息长度为 1024 字节，只有 GET 请求真正有效，消息在 10 秒后会被丢弃 目标 : byuctf.xyz:40011 漏洞分析 漏洞 : HTTP 请求走私（基于 UDP/QUIC） 根本原因 :...

CVE-2025-29927

CVE-2025-29927 — Next.js 中间件身份验证绕过 概述 想象一下，夜店门口站着个保安，如果你告诉他“我已经进来了”，他就不检查直接放你进去。这正是 CVE-2025-29927 所描述的情况。 Next.js 中的中间件在处理请求之前运行，因此是处理身份验证的理想位置。Next.js 使用一个内部的 x-middleware-subrequest 头部来防止递归请求并避免无限循环。此漏洞表明，可以完全绕过或跳过中间件的执行——包括在到达受保护路由之前关键的如身份验证等安全检查。 受影响版本 分支| 修复版本 ---|--- 15.x| /" \ -H...

NextJS-Exploit-

NextSploit: Escáner y Explotador de CVE-2025-29927 para Next.js NextSploit es una herramienta de línea de comandos diseñada para detectar y explotar CVE-2025-29927 , una falla de seguridad en Next.js. La herramienta primero identifica si un sitio web objetivo está utilizando Next.js y determina s...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

CVE-2025-54123

CVE-2025-54123 Hoverfly 命令注入到 RCE PoC 概述 该仓库包含一个用于与受 CVE-2025-54123 影响的 Hoverfly 实例进行交互的 Python 概念验证（PoC）脚本。 脚本支持： 使用用户名/密码凭证进行身份验证 使用现有的 Bearer 令牌进行身份验证 与 Hoverfly 中间件 API 端点进行交互 显示 API 响应输出 警告 本项目仅用于经授权的安全研究、测试和教育目的。未经明确许可，请勿将其用于任何系统。 依赖 Python 3.8+ requests 安装依赖： pip install requests 使用...

CVE-2025-29927__Next.js

CVE-2025-29927 - Next.js 中间件授权绕过 POC ⚠️ 法律声明 : 此工具仅用于安全研究、授权渗透测试和教育目的。在未获得明确许可的情况下，将此工具用于目标系统是非法且不道德的。 📋 概述 CVE-2025-29927 是 Next.js 中的一个关键安全漏洞，攻击者可以通过利用 x-middleware-subrequest 标头的不当处理来绕过基于中间件的授权控制。 🎯 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2025-29927 CVSS 评分| 9.8 严重 受影响版本| Next.js 13.4.0 - 15.2.3 修复版本|...

CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...

CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...

Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)

An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. id: CVE-2012-3153 info: name: Oracle Forms &...

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

CVE-2026-97149

A flaw was found in OpenStack Swift's tempurl middleware. A TempURL is a signed, time-limited link that should allow access to only one object. The signature does not cover extra request headers, and Swift did not block the X-Copy-From header on these signed upload requests. An attacker who alrea...