EUVD-2026-68041

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16061

The Rest Routes WordPress plugin (through version 5.5.5 ) contains an unauthenticated SQL injection vulnerability. A value taken from the URL of a public REST route—specifically the custom-tables/tables/{table_name} endpoint—is not sanitized or validated before being used in a SQL query. This all...

grafana-unauth-file-read

grafana-unauth-file-read : CVE-2021-43798 Grafana में फ़ाइलों का अनधिकृत पठन 0day ऐसा प्रतीत होता है कि Grafana में नया 0day LFI grafana-clock-panel प्लगइन के कारण मौजूद है। इस रूप में एक GET अनुरोध भेजना पर्याप्त है: GET /public/plugins/grafana-clock-panel/../../../../../../../etc/passwd प्लगइन्...

CVE-2025-29927-Nextjs-Analysis

Analisi di Next.js CVE-2025-29927 Questo repository contiene un ambiente di laboratorio Next.js self-hosted creato per analizzare CVE-2025-29927 in Docker. Panoramica CVE-2025-29927 è una vulnerabilità relativa ai controlli di autorizzazione implementati nel middleware di Next.js. Questo progetto...

CVE-2021-43798

CVE-2021-43798 - Lettura Arbitraria di File in Grafana Toolkit Python per test autorizzati di CVE-2021-43798, una vulnerabilità di path traversal in Grafana che può consentire la lettura arbitraria di file senza autenticazione tramite i percorsi degli asset dei plugin. Questo repository contiene:...

CVE-2022-22947_EXP

1. Spring Cloud Gateway दूरस्थ कोड निष्पादन भेद्यता खतरे का स्तर: उच्च जोखिम POC/EXP स्थिति: सार्वजनिक CNVD क्रमांक: CNNVD-2022-16402 CVE क्रमांक: CVE-2022-22947 2. प्रभावित सीमा: VMWare Spring Cloud GateWay 3.1.0 VMWare Spring Cloud GateWay =3.0.0，=3.0.6 VMWare Spring Cloud GateWay 3.0.0 3...

cve-2025-29927

CVE-2025-29927-PoC-Exploit Proof-of-Concept für die Umgehung der Autorisierung in Next.js Middleware Du kannst das hier gegen eine verwundbare Version ausführen: https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927 Ausführung Die Ausführung ist unkompliziert. 1. Python3...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

nextjs-vulnerable-app

Next.js-Authentifizierungs-App Dies ist eine Next.js-Anwendung, die Authentifizierung mithilfe von NextAuth.js implementiert. Die App umfasst geschützte Routen, für die Benutzer authentifiziert sein müssen, um auf bestimmte Seiten zugreifen zu können. Projektstruktur root@kitploit: nextjs-auth-ap...

cve-2014-0130

== CVE-2014-0130 Testfall Payload : http://site/api/%5C../%5C../%5C../%5C../%5C../CATDIR === Von Netsparker erkannt : https://i.imgur.com/s1vahmj.png == HackerOne 1 - newrelic.com Rails-Directory-Traversal-Schwachstelle von droidsec - https://hackerone.com/reports/134032 == Referenzen 1...

CVE-2025-29927

CVE-2025-29927 - Bypass dell'autorizzazione del middleware di Next.js PoC Questa è una Proof of Concept in stile Capture The Flag CTF per la vulnerabilità Bypass dell'autorizzazione del middleware di Next.js CVE-2025-29927. L'obiettivo è bypassare il middleware di autenticazione e recuperare la...

EUVD-2026-66958

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2022-22947-pb-ai

CVE-2022-22947 Spring Cloud Gateway भेद्यता सत्यापन एप्लिकेशन यह CVE-2022-22947 भेद्यता को प्रदर्शित करने और सत्यापित करने के लिए एक समर्पित Spring Cloud Gateway एप्लिकेशन है। यह एप्लिकेशन Spring Cloud Gateway के एक असुरक्षित संस्करण का उपयोग करता है, जिसके माध्यम से Actuator एंडपॉइंट के जरिए...

trappsec

trappsec trappsec è un framework open-source che aiuta gli sviluppatori a rilevare gli attaccanti che sondano la logica di business delle API. Incorporando percorsi esca realistici e campi di miele difficili da distinguere dalle vere costruzioni API, gli attaccanti vengono spinti ad autenticarsi ...

route-detect

route-detect Finden Sie Authentifizierungs- authn und Autorisierungs- authz Sicherheitslücken in Webanwendungs-Routen: Routen deskoel Streaming-Servers HTTP-Routen-Authentifizierungs- und Autorisierungslücken in Webanwendungen gehören heute zu den häufigsten Sicherheitsproblemen. Diese...

CVE-2025-54914-PoC

CVE-2025-54914 Azure Route Exploit Panoramica Questa è un'implementazione migliorata dell'exploit CVE-2025-54914 per il routing di rete di Azure. Questa versione mantiene le funzionalità principali della CVE aggiungendo ulteriori caratteristiche tra cui persistenza, elusione, scansione multi-targ...

pybatfish

Got questions, feedback, or feature requests? Join our community onSlack! Pybatfish Pybatfish is a Python client for Batfish. What is Batfish? Batfish is a network validation tool that provides correctness guarantees for security, reliability, and compliance by analyzing the configuration of...

EUVD-2026-66278

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-55538 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config"apikey" but createagentsapp does not authenticate POST /agents or POST /agents/agentname. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in...