1376 matches found
dir-3040_dos
Отказ в обслуживании dir-3040 Dir-3060 также может быть затронут, так как они используют много общих компонентов из той же прошивки. Протестировано на последней прошивке 1.20b03a hotfix Страница доступа пользователя ftp-сервера по умолчанию настроена так, что любой пользователь с правами записи...
CVE-2024-7808
CVE-2024-7808 💀 $$\colorred THIS \space EXPLOIT \space MAY \space VIOLATE \space THE \space LAW.$$ $$\colorred\space YOU \space ARE \space RESPONSIBLE \space FOR \space YOUR \space ACTIONS.$$ $$\colorredDEMONSTRATION \space PURPOSE \space ONLY.$$ 説明 open-webui における CSRF を介した非管理者ユーザーによる RCE...
CVE-2024-42327
PoC и эксплойт для CVE-2024-42327 / ZBX-25623 Учетная запись неадминистративного пользователя во фронтенде Zabbix с ролью «Пользователь» по умолчанию или любой другой ролью, предоставляющей доступ к API, может использовать эту уязвимость. SQL-инъекция существует в классе CUser в функции...
PyNightmare
PyNightmare PoC для CVE-2021-36934 также известный как HiveNightmare/SeriousSAM полностью написан на python3 Объяснение CVE-2021-36934 — это недавно обнаруженная уязвимость, найденная @jonasLyk, позволяющая неадминистративным пользователям копировать все кусты реестра, содержащие очень приватную...
CVE-2021-42562
CVE-2021-42562: MITRE Caldera의 부적절한 접근 제어 Caldera버전 =2.8.1는 사용자 권한을 제대로 분리하지 않아, 비관리자 사용자가 관리자 사용자만 접근할 수 있어야 하는 구성 또는 기타 구성 요소를 읽고 수정할 수 있게 됩니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 내용은 여기에서 확인할 수 있습니다. 요구사항: 이 취약점에는 다음이 필요합니다: 유효한 비관리자 사용자 자격 증명 개념 증명: 자세한 내용과 악용 과정은 이 PDF에서 확인할 수 있습니다. 추가 리소스: 이 취약점을 통...
CVE-2024-42327
PoC для CVE-2024-42327 / ZBX-25623 Учетная запись пользователя без прав администратора на интерфейсе Zabbix с ролью по умолчанию "Пользователь" или с любой другой ролью, предоставляющей доступ к API, может использовать эту уязвимость. SQL-инъекция существует в классе CUser в функции...
EUVD-2026-71777
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-75602
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...
EUVD-2026-70550
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...
CVE-2026-84989
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717 , two REST v2 endpoints managing the tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check . Any authenticated non-administ...
PT-2026-84674
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-44848-PoC
CVE-2026-44848 — Portainer: Docker 플러그인 엔드포인트에 대한 인가 누락 → 호스트 RCE CVE-2026-44848 에 대한 개념 증명PoC입니다. Portainer의 인증 누락CWE-862 취약점으로, Docker 엔드포인트 접근 권한이 있는 비관리자non-admin 사용자가 권한 있는 Docker 플러그인 작업을 수행하여 완전한 호스트 RCE 에 도달할 수 있게 합니다. GitHub Security Advisory: GHSA-rrmm-9v76-h3p4 · CVSS 9.4 치명적. 근본 원인...
CVE-2026-79747
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...
CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...
CVE-2026-79747
MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, is vulnerable to SSRF prior to version 1.0.32. An authenticated non-admin user can register a server pointing at an arbitrary URL, causing the hub to issue server-side requests with no egress filtering (loopback, R...
CVE-2026-79747 MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...
POC-CVE-2026-19626
CVE-2026-19626 — 보고서 생성 과정의 RCE 인증된 비관리자 상태: 확인됨 — 순수 원격, 비관리자, REST 전용 6.7.2-14.el9 랩, 2026-08-21. 무기화된 공격 체인 poc.py가 수행하는 작업: 1. 일반 조직 사용자로 로그인 2. POST /rest/group 요청에 name: "=system''" 포함 — 중괄호/따옴표가 그대로 허용됨 그룹 컨트롤러에는 문자셋 검사가 없음 3. POST /rest/reportDefinition — PDF 보고서, pieChart 컴포넌트 하나,...