CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761

CVE-2026-74761 is an improper input validation flaw in the TopicRegion component of Apache ActiveMQ (Broker, All, and standalone). An authenticated client can spoof the clientId when removing a durable topic subscription, potentially allowing removal of another client's subscription. Affected ver...

EUVD-2026-74829

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2026-74761 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: before 5.19.11, from 6.0.0 before 6.3.2;...

CVE-2025-26244

CVE-2025-26244-POC 利用此漏洞的代码见'spoof.go'。它模拟为C2服务器的代理。要利用此漏洞，我们需要知道： 1. 监听器的IP地址和端口 2. 监听器的公钥。 3. 监听器的首次回连URL。 我们可以通过逆向分析操作员之前生成的二进制文件来获取这些信息。 目前，'spoof.go'仅在监听器和代理都使用HTTPS协议时有效，但经过适配后，很可能也能支持DeimosC2支持的其他协议。 利用步骤 1）你需要获取操作员之前生成的HTTPS二进制文件。 2）从二进制文件中提取监听器的IP地址、端口、公钥以及首次回连URL。Trend Micro 提供了相关脚本协助此过...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - Suplantación de Contenido sin Autenticación CVE-2025-32259 🔬 Un PoC simple que demuestra CVE-2025-32259 en el plugin WP ULike para WordPress. 🚨 Solo uso educativo – no probar en sistemas sin autorización explícita. 🧠 Resumen WP ULike es un popular plugin de WordPress que...

CVE-2026-40487

CVE-2026-40487 - Postiz 服务器仅验证 Content-Type 头（CWE-345） - 文件以原始 .svg 扩展名保存到磁盘（CWE-434） - nginx 以 image/svg+xml 提供服务 - 浏览器执行嵌入的 JavaScript（CWE-79） - 同源：完全访问受害者的会话 影响 XSS 载荷在同源 下与应用一起执行。即使认证 Cookie 是 HttpOnly，fetch 配合 credentials: "include" 也会自动附加该 Cookie。攻击者可以： 窃取受害者的个人资料、API 密钥、所有已连接社交账户的 OAuth 令...

CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16272

PayTR Virtual Pos iFrame API (v9x) WHMCS Module (versions v9.0.0 through before v9.0.3) is affected by a client IP spoofing vulnerability caused by use of less trusted source —specifically, untrusted HTTP headers are relied upon for identifying the client IP, allowing exploitation of trusted iden...

CVE-2021-23017-POC

CVE-2021-23017-POC A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The issue only affects nginx if the "resolver"...

cve-2025-24054-lab

CVE-2025-24054 — Detection & Mitigation Lab Project log for a defensive security lab on CVE-2025-24054 , the Windows New Technology LAN Manager NTLM Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term. Blue-team educational project...

CVE-2026-87624

A flaw was found in Google Chrome on Android. A remote attacker, after compromising the renderer process, could exploit a user interface UI misrepresentation vulnerability. This vulnerability allows the attacker to spoof UI elements by using a specially crafted HTML page, potentially deceiving...

CVE-2026-87538

A flaw was found in Chromium. A remote attacker, after compromising the renderer process and leveraging social engineering, could exploit a clickjacking vulnerability in the input mechanism. This could allow the attacker to spoof user interface UI elements via a specially crafted HTML page,...

CVE-2026-87502

A flaw was found in Google Chrome. This confused deputy vulnerability in the Fullscreen feature allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to spoof user interface UI elements. This can be achieved by presenting a specially crafted HTML pag...

CVE-2026-87653

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could lead to user interface UI misrepresentation in FullScreen mode, allowing the attacker to spoof UI elements...

CVE-2026-87507

A flaw was found in chromium-browser. A remote attacker, leveraging social engineering tactics, could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to user interface UI misrepresentation within the Downloads section, allowing the attacker to...

CVE-2026-87486

A flaw was found in Google Chrome. This clickjacking vulnerability allows a local attacker, through a co-installed application, to spoof the address bar. This could mislead users about the authenticity of the displayed website...

CVE-2026-87445

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to user interface UI elements being spoofed, potentially misleading users and allowing for information disclosure...

CVE-2026-87540

A flaw was found in Google Chrome. Incorrect authorization in the Isolated component allowed a remote attacker to spoof user interface UI elements. This could be achieved by enticing a user to visit a specially crafted HTML page, leading to a deceptive user experience...

CVE-2026-87568

A flaw was found in Chromium. This improper input validation vulnerability allows a remote attacker, who has compromised the renderer process, to spoof user interface UI elements. This can be achieved by sending crafted network traffic, potentially deceiving users or leading to further attacks...