CVE-2026-90606

CVE-2026-90606 is a buffer overflow in the boa component of Totolink A3002MU (firmware Hh-B20211125.1046). The vulnerable function is formIpv6Setup in the file /boafrm/formIpv6Setup; manipulation of the argument static_ipv6 triggers the overflow. The vulnerability is exploitable remotely with low...

CVE-2026-90606 Totolink A3002MU boa formIpv6Setup buffer overflow

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument staticipv6 leads to buffer overflow. The attack is possible to be carried out...

CVE-2026-90606 Totolink A3002MU boa formIpv6Setup buffer overflow

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument staticipv6 leads to buffer overflow. The attack is possible to be carried out...

CVE-2026-90605 Totolink A3002MU boa formFilter buffer overflow

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

CVE-2026-90605 Totolink A3002MU boa formFilter buffer overflow

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

CVE-2026-90605

CVE-2026-90605 affects the Totolink A3002MU router (firmware Hh-B20211125.1046 ). The vulnerability resides in the boa web server component, specifically in the formFilter function of the file /boafrm/formFilter . Manipulating the ip6addr argument triggers a buffer overflow , allowing a remote at...

CVE-2024-51482

CVE-2024-51482 ZoneMinder v1.37. = 1.37.64 CVE-2024-51482 poc.py デフォルトでは、このスクリプトは zm データベースを列挙し、Users テーブルからデータを取得し、Username+Password 列をダンプします。 これらの4つの要素が存在する場合、ユーザー名とパスワードハッシュが取得されます。 脆弱性の詳細については、次のリンクを参照してください： https://nvd.nist.gov/vuln/detail/CVE-2024-51482 root@kitploit: ZoneMinder is a free,...

cve-2025-55182-poc

基本資訊 CVE-2025-55182 是 2025 年影響最廣的 Web 框架漏洞之一。React Server Components（RSC）已是現代 Next.js 應用的主流架構，大量以 create-next-app 建立的標準專案皆在受影響範圍內，且無需任何客製化程式碼 即可被利用。 項目| 內容 ---|--- CVE 編號| CVE-2025-55182 別稱| React2Shell 漏洞類型| 未認證遠端程式碼執行（Unauthenticated RCE）；CWE-502 反序列化不可信資料（Deserialization of Untrusted Data）3 CV...

CVE-2026-90600

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2026-90602

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90601

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

CVE-2025-0282

CVE-2025-0282 Ivanti Connect Secure IFT TLS 堆栈溢出预认证远程代码执行（RCE）（CVE-2025-0282） 此代码被刻意以非平凡的方式破坏，需要按照我们之前在利用技术博客文章中概述的方法付出努力才能使其正常工作。 要了解此漏洞，可以查看我们的技术文章。 利用演练与技术 - Ivanti Connect Secure RCE（CVE-2025-0282） PoC 该代码以两种模式运行： 1. 正常模式 2. 利用模式...

CVE-2026-73570

CVE-2026-73570 — Zimbra Collaboration Suite RCE Note: This repository contains an independent technical analysis and PoC reproduction of CVE-2026-73570. It is not the original vulnerability report. Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection CVSS 8.9, CI...

CVE-2024-38063

CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution 1. Project Overview This repository contains our research and analysis of CVE-2024-38063 , a critical vulnerability in the Windows TCP/IP stack. CVE stands for Common Vulnerabilities and Exposures. It is a standardized dictionary...

CVE-2025-68860

CVE-2025-68860 WordPress Mobile builder Plugin Mobile Builder における 代替パスまたはチャネルを使用した認証バイパス の脆弱性により、認証の悪用が可能になります。この問題は Mobile builder の n/a から 1.4.2 までに影響します。 CVSS スコア: 9.8 CRITICAL ベクター: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H リモートの攻撃者は、有効な認証トークンを生成し、事前の操作や資格情報なしで管理者アクセスを取得でき、WordPress...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602

A cross-site scripting (XSS) vulnerability affects the renderHistory function in ImageStudio.js within the Studio Components component of Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0). The attack can be initiated remotely and requires low privileges and user interaction , resulting...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90602 Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90601 getzep graphiti REST API main.py improper authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...