CVE-2025-30208-PoC

CVE-2025-30208 - PoC произвольного чтения файлов Vite Это скрипт Proof-of-Concept PoC для эксплуатации CVE-2025-30208, позволяющий произвольное чтение файлов на серверах разработки Vite. Детали уязвимости Vite, поставщик инструментов для фронтенд-разработки, имеет уязвимость в версиях до 6.2.3,...

Security Bulletin: IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine [CVE-2026-18069]

Summary IBM i is vulnerable to obtaining ownership of a file due to a time-of-check to time-of-use race condition CVE-2026-18069 in SQL Query Engine SQE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18069 DESCRIPTION: IBM i could allow a local attacker to...

CVE-2026-18069 IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-18069

CVE-2026-18069 is a time-of-check to time-of-use (TOCTOU) race condition in the SQL Query Engine (SQE) of IBM i (versions 7.3, 7.4, 7.5, and 7.6). A local attacker with low privileges can obtain ownership of arbitrary file system objects , resulting in a changed scope with low impact on confident...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Внедрение неавторизованных операторов NoSQL в Budibase Неавторизованное внедрение операторов JSON/NoSQL в Budibase. Любой анонимный посетитель опубликованного приложения Budibase, которое предоставляет PUBLIC -запрос, основанный на источнике данных документов MongoDB, CouchDB,...

CVE-2026-46591

camel-neo4j Воспроизведение инъекции Cypher CVE-2026-46591 Этот проект демонстрирует инъекцию Cypher в компоненте camel-neo4j Apache Camel, отслеживаемую как CVE-2026-46591. Производитель строит предложение WHERE Cypher для операций match/retrieve и delete из карты CamelNeo4jMatchProperties...

CVE-2026-55253

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-54180

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-50157

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...

CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - PoC SQL-инъекции в Drupal Core PostgreSQL Обзор Этот репозиторий содержит этическое подтверждение концепции PoC для CVE-2026-9082 , критической уязвимости SQL-инъекции в Drupal Core , затрагивающей все сайты на PostgreSQL, работающие на Drupal с версии 8.0 по 11.3.9. Ошибка...

PoC_CVE-2017-3164_CVE-2017-1262

Apache Solr Poc CVE-2017-3164 CVE-2017-12629 Эта папка содержит примеры эксплойтов для Apache Solr CVE-2017-3164 CVE-2017-12629 Использовать ТОЛЬКО в образовательных целях и с полного разрешения владельца сервера Apache Solr. Вам понадобится знать IP-адрес или DNS-имя сервера Apache Solr и имя...

EUVD-2026-77717

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-54180

backpack/crud (v6.0.0–6.8.14, v7.0.38) is a Laravel package for building administration panels. The vulnerability is an insecure direct object reference (IDOR) on write paths : the Update , Delete , and Reorder operations resolved records from the unscoped model query instead of the query configu...

EUVD-2026-77674

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

EUVD-2026-77672

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...

CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...

CVE-2026-50157

Auth0 Symfony SDK (auth0/symfony) versions 5.0.0-BETA0 through 5.9.0 are vulnerable to exposure of sensitive information via the Authorizer security authenticator. The Authorizer::authenticate() and Authorizer::supports() methods accept OAuth 2.0 bearer access tokens from a URL query parameter in...

CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...