CVE-2025-7783-poc

Vulnérabilité de randomisation de délimiteur form-data CVE-2025-7783 Largement basé sur https://hackerone.com/reports/2913312 par https://hackerone.com/parrot409?type=user Installation : npm install Assurez-vous d'avoir python3 installé avec le module z3 pip3 install -r requirements.txt -- le cod...

gattacker

Пакет Node.js для BLE Bluetooth с низким энергопотреблением Man-in-the-Middle и не только. Предварительные требования см.: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Установка npm install gattacker Использование Настройка Для запуска обоих компонентов настройте...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 Описание : позволяет удалённым аутентифицированным пользователям выполнять произвольные команды через меню настроек в «Sotfware Store». Затронутые версии : Все = 6.6.6 Информация Чтобы создать этот PoC, я просто установил программное обеспечение с помощью...

CVE-2026-37432

CVE-2026-37432 Emplacement : Apiutil.java : 107-113 Principe : Faire directement confiance à l'en-tête de requête X-Forwarded-For, qui peut être falsifié pour manipuler les adresses IP. Méthode d'exploitation : X-Forwarded-For : 127.0.0.1...

CVE-2025-63700

CVE-2025-63700 Contournement de l'authentification OAuth dans Clerk-js 5.88.0 Produit concerné Vendeur : Clerk Inc. clerk.dev / clerk.com Produit : Clerk-js @clerk/clerk-js Version concernée : 5.88.0 Impact : Contournement de l'authentification OAuth CWE-290 : Contournement de l'authentification...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785509707)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785509707 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785509707)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785509707 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

Exposure of Resource to Wrong Sphere

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the globalAgent process. An attacker can access sensitive HTTPS credentials and intercept or manipulate...

ROS-20260914-73-0068

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

EUVD-2026-72665

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

CVE-2026-67316

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

CVE-2026-11462

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper...

PT-2026-47190

Name of the Vulnerable Software and Affected Versions BeikeShop versions prior to 1.6.0.22 Description Improper authorization exists in the Stripe Plugin component. A remote attacker can manipulate the Request argument within the callback function of the file...

Iris 安全漏洞

Iris is an open-source fast, simple, yet fully functional and highly efficient Go network framework developed by DFIR-IRIS. Versions of Iris prior to 2.4.28 contained security vulnerabilities, which stemmed from allowing users to manipulate API requests to modify values in the database...

CVE-2018-25358 D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the tablename parameter in POST requests. Attackers can send requests to /mycgi.cgi with tablename values like adminuser,...

CVE-2018-25358

The CVE-2018-25358 entry concerns the D-Link DIR-601 (firmware 2.02NA) where an unauthenticated attacker can disclose credentials via /my_cgi.cgi by manipulating the table_name parameter in POST requests. Affected data includes administrative credentials and wireless keys, exposed in cleartext. T...