CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885

The Krayin laravel-crm software, versions up to 2.2.4 , contains an authorization bypass vulnerability in the admin-config-setup API Endpoint. The flaw originates from an unknown function within the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php. This vulnerability allows for r...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

Metabase-Pre-Auth-RCE-POC

CVE-2023-38646 — Metabase 원격 코드 실행RCE 개념 증명 개요 이 저장소는 CVE-2023-38646 을 분석하는 개념 증명PoC 보안 연구 프로젝트 를 문서화한 것입니다. 이 취약점은 취약한 버전의 Metabase 에 영향을 미치는 사전 인증 없이 가능한 원격 코드 실행RCE 취약점입니다. 이 프로젝트의 목표는 실제 취약점의 전체 수명 주기 를 시연하는 것입니다. 여기에는 다음이 포함됩니다: 취약점 및 근본 원인 이해 통제된 실습 환경에서 익스플로잇 재현 취약한 시스템에 리버스 셸 설정 네트워크 모니터링...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

kernel-debug-lab-for-virtual-box

如何使用 Windbg 设置 VirtualBox 实验室来调试内核驱动程序 这里我们假设计算机 A 上已安装 windbg，计算机 B 上已安装 Visual Studio、SDK 和 WDK。 1. 打开 Host Network Manager，创建或设置一个新的 Virtual Box Host-Only Ethernet adapter 2. 创建或选择一个 Virtual Box Host-Only Ethernet adapter，并勾选 DHCP Server 的 Enable 复选框 3. 对于计算机 A 和计算机 B，进入 Settings - Network，在...

Heartbleed

Heartbleed-POC 이 저장소는 Heartbleed CVE에 대한 유효한 개념 증명을 제공하고, 사전 빌드된 Dockerfile 없이 자체 Heartbleed 챌린지를 설정하는 방법에 대한 지침을 포함하는 것을 목표로 합니다. 실습 환경 구축 방법 1. cd service/heartbleed 또는 cd src 명령어를 사용하여 source/service 디렉토리로 이동합니다. 2. 다음 명령어로 Docker 컨테이너를 빌드합니다: sudo docker build -t heartbleed . 3. 다음 명령어로 Docke...

CVE-2024-4577

CVE-2024-4577 환경 구축 파일 및 PHP파일 --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2021-41773

CVE-2021-41773 脆弱な環境のセットアップ...

CVE-2026-100746

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

EUVD-2026-87884

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100746

A vulnerability exists in coollabsio Coolify (versions up to 4.1.0 ) within the GitHub App Setup Handler component. Specifically, the Github::redirect function in the /webhooks/source/github/redirect file is susceptible to missing authentication due to the manipulation of the state argument. This...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

Security_incident_report

01. インフラ構成 このプロジェクトのインフラはIaCTerraformなどコードでは管理せず、pfSense・Wazuhをインストールした後に管理画面GUIで直接設定を変更 する方式で構成しました。そのため、ここでは「コード」ではなくネットワーク構成図と各設定画面のキャプチャ、そしてどの値をなぜ変更したのかを記録し、再現可能なようにまとめました。 ネットワーク構成 pfSenseを基準に外部WANと内部LANを分離し、スイッチで内部ネットワークをさらに4つのゾーンに分割しました。 区分| 対象システム| IP帯| 役割 ---|---|---|--- DMZ| WEB01 WAF +...

CVE-2026-100885: Authorization Bypass Through User-Controlled Key

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...