RE11S_1.11-formAccept-CommandInjection

RE11S1.11-formAccept-CommandInjection Qi An Xin Tiangong Lab에서 인턴십을 하는 동안 RE11S1.11 라우터에서 명령 주입 취약점을 발견했습니다. bin 디렉터리의 webs 파일을 분석한 결과, formAccept 함수에 명령 주입 취약점이 포함되어 있음을 발견했습니다. 명령 주입은 submit-url 키 값에 의해 트리거될 수 있으며, 이로 인해 시스템 명령 주입이 발생합니다. 라우터를 어떻게 시뮬레이션할 수 있나요 firmAE로 시뮬레이션하려면 다음 명령을 사용하세요. sud...

EUVD-2026-92020

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...

CVE-2026-105116

OpenAM versions prior to 16.1.3 are affected by a latent cross-site scripting (XSS) defect. The vulnerability occurs because the SAML message , relay state , and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. If the cookieHashRedirectEnabled setting is acti...

CSRF-exploit-generator

CSRF-exploit-generator CSRF 익스플로잇 생성기는 사용자가 구성 가능한 매개변수로 CSRF 익스플로잇 폼을 생성할 수 있게 해줍니다. CSRF-exploit-generator 기능 대상 URL 입력: 공격 대상이 될 URL을 지정합니다. POST 매개변수 입력: CSRF 요청을 통해 전송할 POST 매개변수를 추가할 수 있습니다. HTML 폼 생성기: 익스플로잇 데이터가 포함된 POST 방식의 HTML 폼을 생성합니다. JavaScript 자동 제출: 사용자 상호작용 없이 폼을 자동으로 제출하는...

Hybrid Submit

Hybrid Analysis 배치 제출 스크립트 이 Python 스크립트는 폴더를 재귀적으로 스캔하여 실행 파일, 스크립트, 문서 및 기타 관련 파일 을 Hybrid Analysis Falcon Sandbox에 제출하여 자동화된 악성코드 분석을 수행합니다. 특징 디렉터리를 재귀적으로 탐색 지원되는 파일 형식만 제출 아래 목록 참조 비어 있거나, 너무 크거나, 이전에 제출된 파일은 건너뜀 경로 순회 공격 방지 – 파일이 스캔 루트 내에 있는지 확인 심볼릭 링크 건너뛰기 – 중복되거나 의도하지 않은 제출 방지 지속적인 reques...

EUVD-2026-90465

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

magento-upload-auto-submit-zoneh

magento-upload-auto-submit-zoneh CVE-2025-54236 ⚠️ 면책 조항 ⚠️ 중요 경고! 이 도구는 오직 다음을 위해 만들어졌습니다: ✅ 교육 목적 및 보안 연구 ✅ 승인된 침투 테스트 ✅ 소유한 시스템에 대한 보안 평가 ✅ 서면 허가를 받은 취약점 검증 엄격히 금지된 용도: ❌ 명시적 승인 없이 시스템에 접근 ❌ 모든 형태의 불법 활동 ❌ 악의적인 행위 또는 시스템에 피해를 주는 행위 ❌ 컴퓨터 시스템에 대한 무단 접근 ❌ 지역, 주, 연방 법률 위반 저자는 이 도구의 사용으로 인한 오용, 손해...

EUVD-2025-26344

A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been...

UBUNTU-CVE-2026-100077

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...

CVE-2026-100077

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...

PT-2026-98367

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.120.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can permanently...

CVE-2026-100077: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...

CVE-2026-96892

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used...

CVE-2026-96892 Edimax BR-6428nC goform websRedirect redirect

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used...

PT-2026-97697

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC version 1.16 Description A flaw exists in the websRedirect function of the goform Handler component. A remote attacker can manipulate the submit-url argument to cause an open redirect, which occurs when an application redirect...

GHSA-584P-F93J-WPGC Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Impact The anonymous front-end action formie/submissions/submit SubmissionsController::actionSubmit trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the formie/submissions/submit action. An attacker can overwrite or hijack another user's incomplete submission by supplying a crafted submissionId parameter without proper session binding, ownership validation,...

PT-2026-97501

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description The anonymous endpoint 'formie/submissions/submit' in the SubmissionsController::actionSubmit function trusts a client-supplied submissionId when loading incomplete...

PT-2026-96676

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.3 Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

CVE-2026-93741

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has...