CVE-2026-88891 OpenPanel Read-Only Access Level Enforcement Bypass via Mutations

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2025-57819_FreePBX-PoC

FreePBX SQL Injection Checker 🔍 Safe, read-only SQLi detector for FreePBX’s /admin/ajax.php focused on template, model, and brand parameters. 🛡️ Uses error-based , boolean-based , and time-based techniques to flag potential injection without modifying the database. ✍️ Per-parameter verdicts + clean...

CVE-2026-88264

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - Omisión de autenticación para extraer usuarios administradores y configuración LDAP - Esta PoC solo realiza acciones de solo lectura. Ejecutar exploit root@kitploit: USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Ejecutar...

CVE-2026-31431

copy.fail — AFALG AEAD splice primitive CVE-2026-31431 Overview This project is a C port of the original Python prototype, by offsecguy. It leverages the Linux kernel crypto API AFALG using: authencesnhmacsha256,cbcaes AEAD mode MSGMORE flag splice system call The technique feeds data from a...

dirty-frag-check

Dirty Frag 检查（CVE-2026-43284 / CVE-2026-43500） 针对“Dirty Frag”Linux 内核本地提权漏洞的只读检查器 （CVE-2026-43284、 CVE-2026-43500）。 检查内核版本、模块状态、KernelCare livepatch 以及您添加的任何 modprobe 黑名单。不运行漏洞利用代码。 配套工具：CVE-2026-31431-check。 注意：这是启发式检查。绿色结论并不代表绝对安全。在判定主机安全之前， 请与您所用发行版的安全公告交叉核对。MIT 许可，不提供任何担保。 快速运行 root@kitploit:...

dirty-frag-check

Dirty Frag check CVE-2026-43284 / CVE-2026-43500 Read-only checker for the "Dirty Frag" Linux kernel local-root vulns CVE-2026-43284, CVE-2026-43500. Checks kernel version, module state, KernelCare livepatch, and any modprobe blacklist you've added. Doesn't run exploit code. Companion to...

PT-2026-89402

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911

CVE-2026-87911 is a CRITICAL (CVSS 9.6) OS command injection vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7. The flaw lies in the read-only enforcement , which can be bypassed by injecting a crafted COPY ... TO PROGRAM statement into con...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

EUVD-2026-75127

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2016-5195

This record is for learning purposes only; any illegal use is prohibited. Principle The vulnerability works by concurrently flushing dirty pages, causing the content of a file that was originally read-only to be modified. If the modified file is owned by root and has the SUID permission, it can b...

CVE-2026-85788

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788

CVE-2026-85788 affects the mutable SQL detector component in Amazon awslabs mysql-mcp-server . An incomplete list of disallowed inputs allows context-dependent actors to bypass the read-only enforcement gate by crafting SQL inline comments that the regex engine does not treat as whitespace, reach...

EUVD-2026-75104

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-87808

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...