480 matches found
ff4j__ff4j_CVE-2022-44262_1_8_13_fixed
✨✨✨ FF4J - Feature Flipping para Java ✨✨✨ Codacy Badge FF4j es una implementación del patrón Feature Toggle. 🤘Características Feature Toggle: Activa y desactiva funciones en tiempo de ejecución, sin despliegues. En tu código, implementa múltiples rutas protegidas por predicados dinámicos...
CVE-2023-40355
🚨 CVE-2023-40355 检查器 欢迎使用 CVE-2023-40355 检查器 ！这个 Python 脚本旨在测试 Web 应用程序中是否存在 CVE-2023-40355 漏洞。 📋 描述 Axigen 版本 10.3.3.0 之前（不含 10.3.3.59）、10.4.0 之前（不含 10.4.19）以及 10.5.0 之前（不含 10.5.5）中存在跨站脚本（XSS）漏洞，允许经过身份验证的攻击者通过标准版和 Ajax 版本之间的切换逻辑执行任意代码并获取敏感信息。 📋 功能特性 域名测试 ：检查 domain.txt 文件中列出的多个域名是否存在...
weakpass
Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
YIKES Inc. Custom Product Tabs for WooCommerce plugin \u003C= 1.7.7 contains a broken access control caused by improper permission checks in &yikes-the-content-toggle option update, letting attackers modify content without authorization. id: CVE-2022-28666 info: name: Custom Product Tabs for...
AMSI-ETW-Patch
AMSI-ETW-Patch Este repositorio contiene información para parchear AMSI y ETW usando un parche de un solo byte para ambos. La idea era limitar la detección del propio parche, ya que es un solo byte. AMSI patch-amsi-x64.c La idea es que AMSI realiza muchas comprobaciones de validación antes de...
ff4j__ff4j_CVE-2022-44262_1-8-13
✨✨✨ FF4J - 面向Java的特性开关 ✨✨✨ Codacy Badge FF4j 是 Feature Toggle（特性开关） 模式的一种实现。 🤘特性 特性开关： 运行时启用或禁用特性——无需重新部署。在你的代码中，通过动态谓词（if/then/else）实现多路径执行。 基于角色的开关： 不仅通过开关值启用特性，还可以通过角色和组（金丝雀发布）控制访问。支持多种框架，从 Spring Security 开始。 基于策略的开关： 实现自定义谓词（策略模式）来评估特性是否启用。开箱即用提供：白名单/黑名单、基于时间、基于表达式。可连接外部来源如 Drools 规则引擎。 AOP...
PoC_CVE-2025-2568
PoC CVE-2025-2568 Resumen El plugin Vayu Blocks – Gutenberg Blocks para WordPress y WooCommerce es vulnerable a acceso no autorizado y modificación de datos debido a la falta de comprobaciones de capacidad en las funciones vayublocksgettoggleswitchvaluescallback y vayublockssavetoggleswitchcallba...
EUVD-2026-87460
OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...
CVE-2026-4123
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...
CVE-2026-4123 RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...
PT-2026-96664
Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...
PT-2026-97048
Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description An issue exists where the system authorizes the creation of a feature in a destination project but fails to verify if the user has access to the source project. Since feature names are globally uniqu...
Linux Distros Unpatched Vulnerability : CVE-2026-92495
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still...
CVE-2026-92495 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...
EUVD-2026-81041
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...
CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...
CVE-2026-56827
Shopper , a headless e-commerce admin panel, contains an authorization bypass in five Filament groupedBulkActions blocks (Attribute, Tag, Brand, Category, Supplier pages) that omit the ->authorize() permission gate while page access requires only read-only browse_* permissions. A browse-only s...
CVE-2026-59570
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...