CVE-2026-93758

A flaw was found in Mongoid. An authenticated remote attacker with basic application privileges could exploit an insecure direct object reference in the nested attributes handling. This vulnerability allows the attacker to reference and manipulate record identifiers belonging to other users,...

CVE-2026-97685

In LimeSurvey Community Edition 7.3.0 , an authenticated user with survey creation privileges can perform a cross-survey object authorization bypass via the REST survey-patching endpoint . While the endpoint correctly validates permissions against the survey ID in the URL, the underlying persiste...

CVE-2026-48909-Joomla-SP-Exploit

CVE-2026-48909 Joomla SP LMS — 인증되지 않은 PHP 객체 주입 → 원격 코드 실행 CVE-2026-48909에 대한 개념 증명 평가 도구 저자: Sudeepa Wanigarathna !IMPORTANT 승인된 사용만 허용됩니다. 이 도구는 보안 연구, 교육, 그리고 귀하가 소유하거나 명시적 서면 허가를 받은 시스템 테스트를 위한 것입니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 저자는 오용에 대한 책임을 부인합니다. 목차 개요 취약점 세부 정보 기능 설치 빠른 시작 사용 가이드 명령어 참조...

CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...

CVE-2025-22510

CVE-2025-22510 1️⃣ 구성 요소 유형 WordPress 플러그인 2️⃣ 구성 요소 세부 정보 구성 요소 이름 WC Price History for Omnibus 취약한 버전 이 플러그인을 활성화하려면 WooCommerce 플러그인이 먼저 설치 및 활성화되어 있어야 합니다. 2. PHP 객체 주입 취약점을 테스트하려면 wp-config.php 파일 맨 아래에 다음 클래스 PoCPOPChainObject를 추가합니다. class PoCPOPChainObject public $message = ""; public...

cve-2021-40444

cve-2021-40444 cve-2021-40444를 악용하는 'A Letter Before Court 4.docx' 악성 파일 리버스 엔지니어링 악성 워드 파일과 cab 파일을 포함한 파일들은 any.run에서 다운로드할 수 있습니다: https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ 참고! 원본 악성 코드의 도메인 이름은 악성 코드 실행 시 실수를 방지하기 위해 127.0.0.1:8000 으로 대체되었습니다. 따라서 자신의 championship.inf...

CVE-2026-98037

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. An improper validation check fails to reject untrusted allocated-object pointers after their protection scope expires, incorrectly recognizing them as valid live objects. A local user with permissions to load BPF programs...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Office RCE、別名 msdt follina 情報 : Microsoft Officeのゼロデイ脆弱性、PowerShellを実行する攻撃に使用される 概要 2022年5月29日、独立したサイバーセキュリティ研究チームであるNaoSecチームは、Virustotalで共有されていた悪意のあるOffice文書を発見しました。この文書は、被害者に感染させるために、異常ではあるが既知のスキームを使用しています。このスキームは、Microsoft Defender for...

EUVD-2026-69250

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types incomplete PolymorphicTypeValidator denylist...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

EUVD-2026-88469

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.6.3 . The flaw exists in the cp_display_preview_modal AJAX action because the nonce guard fails open when the cp_admin_page_nonce parameter is omitted, and there is no capability check on ...

RedTeamBrasil-CVE-2025-64459

connector-sqli Django ORM의 SQL 인젝션 자동 익스플로잇 Q-object connector · CVE-2025-64459 🎥 RedTeam Brasil 채널 — 포르투갈어로 실전 공격 보안. ██████╗ ████████╗██████╗ connector-sqli ██╔══██╗╚══██╔══╝██╔══██╗ Django Q connector SQLi ██████╔╝ ██║ ██████╔╝ CVE-2025-64459 ██╔══██╗ ██║ ██╔══██╗ RedTeam Brasil 채널 ██║ ██║ ██║...

CVE-2026-34213

CVE-2026-34213 Docmost의 권한이 낮은 사용자가 피해자의 attachmentId를 일반 업로드 엔드포인트에 제공하고 동일한 워크스페이스 내 다른 페이지의 저장된 첨부 파일을 덮어쓸 수 있습니다. 소개 저는 Docmost오픈소스 협업 문서화 플랫폼에서 High 심각도의 인가 결함을 식별하고, 책임감 있게 공개했으며, 재현했습니다. Docmost의 공식 사이트는 이 플랫폼을 300만 회 이상 다운로드 된 엔터프라이즈급 온프레미스 위키로 소개하며, Vilnius City , Bechtle , 호주 정부 , 적십자 ,...