11677 matches found
cve-2025-29927
CVE-2025-29927 CVE-2025-29927 μ·¨μ½μ Next.jsμ 11.1.4λΆν° 13.5.6κΉμ§, 14.xμ 14.2.25 λ―Έλ§, 15.xμ 15.2.3 λ―Έλ§μ λͺ¨λ λ²μ μ΄ μ΄ μ·¨μ½μ μ μν₯μ λ°μ΅λλ€. νΉν μ κ·Ό μ μ΄ κ΅¬νμ μν΄ λ―Έλ€μ¨μ΄μ μμ‘΄νλ μ ν리μΌμ΄μ μμ μν₯μ΄ ν¬λ©°, 곡격μλ μΈμ¦ μμ΄ λ³΄νΈλ 리μμ€μ λ¬΄λ¨ μ κ·Όν μ μμ΅λλ€. μ·¨μ½μ λ©μ»€λμ¦ CVE-2025-29927 μ·¨μ½μ μ Next.jsκ° x-middleware-subrequest ν€λλ₯Ό μ²λ¦¬νλ λ°©μμ μ€κ³ κ²°ν¨μμ λΉλ‘―λ©λλ€. μ΄ ν€λλ μ...
cve-2025-29927-poc
CVE-2025-29927-POC Introduction This repository contains a Proof of Concept PoC for CVE-2025-29927, a hypothetical vulnerability demonstrating a flaw in middleware handling within a web application. The PoC illustrates how a specially crafted HTTP request can bypass redirection logic to access...
Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927
Vulnerable Next.js App for Pentesting Practice This is a Next.js application intentionally designed to be vulnerable to CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability. β οΈ Disclaimer This application is for educational and ethical hacking purposes only. Do not deploy it t...
oauth2-proxy
OAuth2 Proxy es una herramienta flexible de cΓ³digo abierto que puede actuar como un proxy inverso independiente o como un componente de middleware integrado en configuraciones existentes de proxy inverso o balanceadores de carga. Proporciona una forma simple y segura de proteger tus aplicaciones...
limitrr-php
Redisλ₯Ό μ¬μ©νμ¬ PHP λ΄μμ κ°λ²Όμ΄ μλ μ νμ μ 곡ν©λλ€. Limitrr PHPλ μ κ° λ§λ λ€λ₯Έ λΌμ΄λΈλ¬λ¦¬μΈ NodeJSμ© Limitrrμμ ν¬κ² μκ°μ λ°μμ΅λλ€. μ¬κΈ°μμ νμΈν΄ 보μΈμ. Limitrr PHPλ₯Ό μ¬μ©νλ©΄ μ ν리μΌμ΄μ μ μλ μ νμ μ½κ² ν΅ν©ν μ μμ΅λλ€. λ€λ₯Έ μ μ¬ν ν¨ν€μ§μ λ¬λ¦¬ μ΄ μ νΈλ¦¬ν°λ μμ² μλΏλ§ μλλΌ μλ£λ μμ μμ: νΉμ μκ° λ΄μ μ±κ³΅μ μΌλ‘ μμ±ν μ μλ κ³μ μλ μ νν μ μμΌλ©°, κ·Έλ¬ν μ νμ μ¬μ©μ μ§μ μ΅μ μ μ μ©ν μ μμ΅λλ€. λν μ¬μ©μ μ§μ ...
CVE-2025-29927_Next.js_Auth_Bypass
CVE-2025-29927 - Next.js μΈμ¦ μ°ν PoC μ΄κ²μ Next.js λ‘ κ°λ°λ μ ν리μΌμ΄μ , νΉν μΈμ¦ λ―Έλ€μ¨μ΄ λ₯Ό μ¬μ©νλ κ²½μ°μ μν₯μ λ―ΈμΉλ μ¬κ°ν μ·¨μ½μ CVE-2025-29927 μ νμ§νκΈ° μν Python Proof of ConceptPoCμ λλ€. π μ΄ μ·¨μ½μ μ λ―Έλ€μ¨μ΄κ° μλͺ» ꡬνλ κ²½μ° λ³΄νΈλ κ²½λ‘μ μ κ·Όνμ¬ μΈμ¦μ μμ ν μ°νν μ μμ΅λλ€. π§ μ€λͺ CVE-2025-29927 μ 곡격μκ° νΉμ κ²½λ‘λ ꡬμ±μ΄ μμλμμ λ Next.jsμ μΈμ¦ λ―Έλ€μ¨μ΄λ₯Ό μ°νν μ μκ² ν©λλ€. μ΄λ Edg...
CVE-2025-29927-PoC-Exploit
CVE-2025-29927-PoC-Exploit Next.js λ―Έλ€μ¨μ΄μ κΆν λΆμ¬ μ°νAuthorization Bypassμ λν κ°λ μ¦λͺ PoC μ·¨μ½ν λ²μ μ μ¬κΈ°μμ ν μ€νΈν μ μμ΅λλ€: https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927 μ€ν μ€ν λ°©λ²μ κ°λ¨ν©λλ€. 1. Python3 CVE-2025-29927-PoC-Exploit.py λλ©μΈ μ΄λ¦μ μ λ ₯νλΌλ λ©μμ§κ° νμλ©λλ€. λ κ°μ§ μ΅μ μ΄ μμ΅λλ€: 첫째, λλ©μΈ μ΄λ¦λ§ μ λ ₯νμΈμ. λμ§Έ, κ²½λ‘...
vulnerable-nextjs-14-CVE-2025-29927
CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint $ curl...
bluemonday
bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...
CVE-2025-29927-Testing
Testing script for CVE-2025-29927 Provided by CyberMaxx. CVE-2025-29927 Tester This PowerShell script is designed to help security researchers and system administrators test for CVE-2025-29927 vulnerabilities in Next.js applications. It checks whether a target application is vulnerable to the...
CVE-2025-29972
CVE-2025-29927 - Critical Security Vulnerability in Next.js Overview CVE-2025-29927 is a critical security vulnerability affecting Next.js , a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js...
dismap
π Dismap - Asset discovery and identification tool δΈζ Readme Dismap positioning is an asset discovery and identification tool. It can quickly identify protocols and fingerprint information such as web/tcp/udp, locate asset types, and is suitable for internal and external networks. It assists red...
poc-cve-2025-29927
Next.js λ―Έλ€μ¨μ΄ μ°ν CVE-2025-29927 κ°λ μ¦λͺ μ΄ μ μ₯μλ Next.js μ μ¬κ°ν μ·¨μ½μ μΈ CVE-2025-29927 μ λν κ°λ μ¦λͺ POCμ ν¬ν¨ν©λλ€. μ΄ μ·¨μ½μ μ 곡격μκ° λ―Έλ€μ¨μ΄μ ꡬνλ κΆν λΆμ¬ κ²μ¬λ₯Ό μ°νν μ μκ² ν©λλ€. π λͺ©μ°¨ 1. POC μ ν리μΌμ΄μ μ€ν 2. μ΅μ€νλ‘μ μ€ν¬λ¦½νΈ μ¬μ© 3. μ·¨μ½μ μμ λ°©λ² 4. μ·¨μ½μ μΈλΆ μ 보 POC μ ν리μΌμ΄μ μ€ν μ΄ Next.js μ ν리μΌμ΄μ μ 보νΈλ λμ보λ κ²½λ‘λ₯Ό ν΅ν΄ μ·¨μ½μ μ μμ°ν©λλ€. μ€μΉ λ°©λ² 1. μ μ₯μλ₯Ό ν΄λ‘ ν©λλ€. 2. μ€μΉ...
Oracle WebLogic Server - Remote Code Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...
OpenFlagr <= 1.1.18 - Authentication Bypass
OpenFlagr = 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests. id: CVE-2026-0650 info: name: OpenFlagr = 1.1.18 -...
Vendure - Arbitrary File Read
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
FastChat - Open Redirect
Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs. id: CVE-2024-10908 info: name: FastChat - Open Redirect author: DhiyaneshDK severity: medium description: | Detects an open redirect vulnerability in lm-sys/fastch...
Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting
The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2....
Next.js Middleware - Server-Side Request Forgery
In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next, an attacker could exploit this behavior to perform Server-Side Request Forgery SSRF attacks. id: CVE-2025-57822 info: name: Next.js Middleware - Server-Side Request Forgery author:...
Krayin CRM < 2.2.1 - Installer Authentication Bypass
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrati...