hpfeeds

hpfeeds About hpfeedsは、軽量で認証付きのパブリッシュ/サブスクライブプロトコルです。シンプルなワイヤーフォーマットを備えているため、誰でもお気に入りの言語でほぼ即座にフィードにサブスクライブできます。異なるフィードはチャンネルごとに分離され、任意のバイナリペイロードをサポートします。つまり、チャンネルの利用者がデータ構造を決定します。hpfeedsではJSONをやり取りするのが一般的です。 このプロジェクトは、asyncio上に構築されたモダンなPython 3互換のブローカーと、Python 3互換のクライアントを提供することを目的としています。...

Subscribe to Category <= 2.7.4 - SQL Injection

The Subscribe to Category contains a sqlinjection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2023-32590 info: name: Subscribe to Category = 2.7.4 - SQL Injection author:...

WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

FluentCRM WordPress plugin = 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key. id: CVE-2026-7798 info: name:...

miniupnpd_poc

Miniupnpd path が526バイトを超えるコールバックURIを含む SUBSCRIBE リクエストを送信することで引き起こされます。 根本原因は、snprintf の戻り値を検証していないことです。snprintf は実際にコピーしたバイト数ではなく、コピー できたであろう バイト数を返すためです。 2019年1月25日時点で、このリポジトリ内のPoCはGoogle Wifiに対して正常にテストされています。 miniupnpd を利用する他のデバイスも影響を受ける可能性があります。 根本原因 upnpevents.c static void...

MAL-2026-17370 Malicious code in @nyzzpedia/baileys-new (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CallStranger

CallStranger このスクリプトは、CallStranger（CVE-2020-12695）の脆弱性を検査するために、Yunus Çadırcı（https://twitter.com/yunuscadirci）によって作成されました。攻撃者はこの脆弱性を以下の目的に利用できます: DLPを回避してデータを外部に送信する（データ窃取） 増幅反射型TCP DDoS / SYN Floodの送信元として、インターネットに公開された数百万台のUPnPデバイスを利用する インターネットに公開されたUPnPデバイスから内部ポートをスキャンする...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - 認証なしSQLインジェクション 説明 WordPress用プラグインSubscribe to...

GHSA-4FWH-WRM6-97XM Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

EUVD-2026-85575

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-86065

Klever-Go , the Go implementation of the Klever blockchain protocol, is vulnerable to remote denial-of-service (DoS) via the unauthenticated GET /subscribe endpoint prior to version 1.7.20 . The vulnerability stems from three compounding gaps: permissive origin handling (allowing any web origin),...

CVE-2026-91073

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

EUVD-2026-85058

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

WordPress Subscribe Forms plugin 1.4.1-1.6.2 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form versions 1.4.1-1.6.2...

CVE-2026-91073

The Subscribe Forms WordPress plugin (versions 1.4.1-1.6.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape specific form settings before they are outputted on a page. This allows authenticated users with the Author role ...

PT-2026-97195

Name of the Vulnerable Software and Affected Versions Subscribe Forms versions prior to 1.6.3 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to sanitize and escape a form setting before it is output on a page. This allows authenticated users with the Author role or...

CVE-2026-91073: Improper Neutralization of Input During Web Page Generation

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

PT-2026-97530

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The 'GET /subscribe' endpoint accepts unauthenticated WebSocket clients with permissive origin handling and lacks a live-connection cap or a call to SetReadLimit to bound message size. Additionall...