36 matches found
CVE-2026-53595_exploit
CVE-2026-53595 + CVE-2026-53593 — FreeScout 匿名 ATO → RCE 通过串联两个漏洞实现在 FreeScout ≤ 1.8.223 （一个 Laravel 帮助台）上的未认证远程代码执行，这两个漏洞均在 1.8.224 中修复： CVE-2026-53595 — 匿名账户接管 。POST /user-setup/hash/invitesentat 仅通过 invitehash 列选取账户。一个已激活 的用户其 invitehash = ''，而在 MySQL/MariaDB 上 VARCHAR 相等比较忽略尾部空格 ，因此 hash = %2...
CVE-2024-1874
CVE-2024-1874 针对 CVE-2024-1874 的概念验证 通过 procopen 的类数组 $command 参数实现命令注入（绕过 CVE-2024-1874 修复） 该 CVE： 在 PHP 8.1.（8.1.29 之前）、8.2. （8.2.20 之前）、8.3.（8.3.8 之前）版本中，针对 CVE-2024-1874 的修复在命令名称包含尾随空格时无效。原始问题：当使用数组语法调用 procopen 命令时，由于转义不充分，如果被执行命令的参数受到恶意用户控制，则该用户可提供参数，从而在 Windows shell 中执行任意命令。 我已经用 Python 和...
CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...
CVE-2026-59954 Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a...
EUVD-2026-44725
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a...
PYSEC-2026-2044 Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extensio...
Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extensio...
Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hwpq-rrpf-pgcq. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered...
CVE-2026-32065 OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to...
Arbitrary File Access
Werkzeug is vulnerable to Arbitrary File Access. The vulnerability is due to insufficient validation in the safejoin function on Windows, where path segments using reserved device names such as CON or AUX with extensions or trailing spaces are allowed, enabling attackers to access special device...
SUSE CVE-2026-21860
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...
Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extensio...
CVE-2026-21860
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...
CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...
CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present...
CVE-2026-21860
CVE-2026-21860 affects Werkzeug’s safe_join on Windows, allowing segments with Windows device names (e.g., CON, AUX) plus extensions or trailing spaces in versions prior to 3.1.5. IBM-security notices confirm real-world impact in affiliated products: IBM Watson Discovery Cartridge (InfoSphere/Dis...
CVE-2025-55127
HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...
CVE-2025-55127
HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...
CVE-2025-55127
HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...