gattacker

BLE ब्लूटूथ लो एनर्जी मैन-इन-द-मिडल और अधिक के लिए एक Node.js पैकेज। पूर्वापेक्षाएँ देखें: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno स्थापना root@kitploit: npm install gattacker उपयोग कॉन्फ़िगर करें दोनों घटकों को चलाने के लिए config.env में वेरिएबल सेट करें:...

CVE-2025-7783-poc

ثغرة عشوائية في حدود بيانات النموذج CVE-2025-7783 مبنية بشكل كبير على https://hackerone.com/reports/2913312 بواسطة https://hackerone.com/parrot409?type=user التثبيت: npm install تأكد من تثبيت python3 مع الوحدة z3 pip3 install -r requirements.txt -- كود الاستغلال يستدعي python3 لتوقع القيمة...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 الوصف : يسمح للمستخدمين المصادق عليهم عن بُعد بتنفيذ أوامر عشوائية عبر قائمة الإعدادات في متجر البرامج. الإصدار المتأثر : جميع الإصدارات = 6.6.6 معلومات لإعداد هذا الـ PoC، قمت فقط بتثبيت البرنامج باستخدام docker-compose نوع الثغرة : تنفيذ الأوامر عن بُعد RC...

CVE-2026-37432

CVE-2026-37432 الموقع: Apiutil.java: 107-113 المبدأ: الثقة المباشرة في رأس الطلب X-Forwarded-For، والذي يمكن تزويره للتلاعب بعناوين IP. طريقة الاستغلال: X-Forwarded-For: 127.0.0.1...

CVE-2025-63700

CVE-2025-63700 Clerk-js 5.88.0 में OAuth प्रमाणीकरण बाइपास प्रभावित उत्पाद विक्रेता : Clerk Inc. clerk.dev / clerk.com उत्पाद : Clerk-js @clerk/clerk-js प्रभावित संस्करण : 5.88.0 प्रभाव : OAuth प्रमाणीकरण बाइपास CWE-290 : स्पूफिंग द्वारा प्रमाणीकरण बाइपास बग लेखक Hasnat Ibrahim Nishat - LinkedIn ...

CVE-2026-67316

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

CVE-2026-11462

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper...

PT-2026-47190

Name of the Vulnerable Software and Affected Versions BeikeShop versions prior to 1.6.0.22 Description Improper authorization exists in the Stripe Plugin component. A remote attacker can manipulate the Request argument within the callback function of the file...

Iris 安全漏洞

Iris is an open-source fast, simple, yet fully functional and highly efficient Go network framework developed by DFIR-IRIS. Versions of Iris prior to 2.4.28 contained security vulnerabilities, which stemmed from allowing users to manipulate API requests to modify values in the database...

CVE-2018-25358 D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the tablename parameter in POST requests. Attackers can send requests to /mycgi.cgi with tablename values like adminuser,...

CVE-2018-25358

The CVE-2018-25358 entry concerns the D-Link DIR-601 (firmware 2.02NA) where an unauthenticated attacker can disclose credentials via /my_cgi.cgi by manipulating the table_name parameter in POST requests. Affected data includes administrative credentials and wireless keys, exposed in cleartext. T...

EUVD-2021-34834

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted filename and foldername parameters to delete...

CVE-2026-7416

Summary: CVE-2026-7416 affects PolarVista xcode-mcp-server 1.0.0, specifically the MCP Interface’s build_project/run_tests in src/index.ts. The vulnerability arises from manipulating the Request argument, enabling an OS command injection. The advisory notes remote feasibility and public disclosur...

CVE-2026-7234 BrowserOperator browser-operator-core server.js startsWith path traversal

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/componentserver/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploit...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution through the mergeConfig code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config obje...

CVE-2025-65133

A SQL injection vulnerability exists in the School Management System version 1.0 by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information...

GHSA-2VRM-GR82-F7M5 AIOHTTP has CRLF injection through multipart part content type header construction

Summary An attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits. Impact If an application allows untrusted data to be used for the multipart contenttype parameter when constructing a request, an attacker may be able to manipulate th...

SourceCodester Pharmacy Product Management System 安全漏洞

SourceCodester Pharmacy Product Management System is an open-source drug management system developed by SourceCodester. Version 1.0 of the SourceCodester Pharmacy Product Management System contains a security vulnerability. This vulnerability arises from the fact that the add-sales.php file does...

ALPINE-CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngxmailsmtpmodule module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation...