CVE-2022-28113

Fantec MWiD25-DS CVE-2022-28113 分析报告 作者：@code-byter ========================== 这是一篇关于 Fantec MWiD25-DS 旅行路由器（固件版本：2.000.030）漏洞利用的分析报告。该漏洞允许任何未经授权的用户以 root 身份执行任意命令。备份功能（upload.csp）中的漏洞允许任何用户写入文件，从而无需有效会话 Cookie 即可重置用户密码。利用这些新凭据，攻击者可以登录 Web 界面并利用缓冲区溢出漏洞。设置 WiFi 客户端功能的 SSID...

WP Travel Engine <= 5.7.9 - SQL Injection

WP Travel Engine 5.7.9 and earlier contains a SQL injection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL queries, exploit requires user interaction. id: CVE-2024-30502 info: name: WP Travel Engine = 5.7.9 - SQL Injection...

WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting

WordPress AB Google Map Travel plugin through 3.4 contains multiple stored cross-site scripting vulnerabilities. The plugin allows an attacker to hijack the administrator authentication for requests via the 1 lat Latitude, 2 long Longitude, 3 mapwidth, 4 mapheight, or 5 zoom Map Zoom parameters i...

glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

GL.iNet Beryl AX Triple RCE PoC GL.iNet GL-MT3000 Beryl AX 여행용 라우터 펌웨어 = 4.4.5에서 발견된 세 가지 인증 없는 명령 주입 취약점CVE-2026-11450, CVE-2026-11451, CVE-2026-11452에 대한 PoC입니다. 전체 분석 글: https://www.hunt-benito.com/blog/glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router...

ttddbg

ttddbg - Time Travel Debugging IDA 플러그인 ⚠️ IDA 8 사용자 주의: 현재 IDA 8에서 ttddbg를 사용하려면 임시 해결 방법이 필요합니다.알려진 문제를 참조하세요. 이 플러그인은 WinDBG Preview로 생성된 Time Travel Debugging 트레이스의 로드를 지원하는 새 디버거를 IDA에 추가합니다. 이 플러그인은 x86 및 x64 트레이스를 모두 지원하며, 그에 따라 IDA 및 IDA64도 지원합니다. 설치 플러그인 설치는 릴리스 페이지의 설치 프로그램을 사용하여 수행할 수...

yara-ttd

yara-ttd - 궁극의 패커 천적 Time Travel Debugging 트레이스에서 YARA 규칙 사용 1. 데모 2. 동기 3. 설치 4. 사용법 5. 향후 기능 데모 UPX로 패킹된 바이너리 calc.exe를 실행하는 간단한 바이너리로, UPX로 패킹되어 있습니다. yara-ttd 는 스레드 생성 중 모듈 메모리에서 calc.exe 문자열을 찾습니다. calc.exe를 실행하는 간단한 난독화된 셸코드 테스트한 바이너리는 셸코드를 복호화한 후 새 스레드에서 실행합니다. yara-ttd 는...

ImpossibleTravelLogAnalysis

NCC Group의 Impossible Travel 로그 분석 소개 IP 주소 지리 정보를 통해 불가능한 이동impossible travel을 탐지하는 기본 로그 분석 도구 예상 데이터 형식 다음 헤더를 포함하는 CSV 파일 When,User,Event,IP 다음 형식을 따릅니다 2019-04-09 00:00:00,user2493,AUTHSUCCESS,101.193.251.145 필드 구조는 다음과 같습니다: When : YYYY-MM-DD HH:mm:SS 형식 User : 사용자 이름 Event : 인증 또는 관심 있는 기타...

CVE-2020-29669

=============== Macally WIFISD2-2A82 CVE-2020-29669 분석 Maximilian BarzSilky와 Daniel Schwendnercode-byter 작성 ========================== 이 문서는 Macally WIFISD2-2A82 여행용 라우터펌웨어 버전: 2.000.010를 공격하는 방법에 대한 분석입니다. 게스트 사용자는 자신의 비밀번호를 재설정할 수 있습니다. 이 과정에는 관리자 계정을 탈취하고 셸 액세스를 얻는 데 사용될 수 있는 취약점이 있습니다. 관리자 사용...

EUVD-2026-86340

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...

CVE-2026-77320

The collaborative travel planner TREK is vulnerable to an information disclosure flaw in versions prior to 3.3.0 . The getSharedTripData function in server/src/services/shareService.ts fails to respect the share_map permission on the server-side. Consequently, while the client UI may hide the map...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 6.8.0 . The root cause lies in the wte_get_template function, which allows authenticated attackers with contributor-level access or hig...

CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

PT-2026-96684

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.1 Description The plugin contains a Local File Inclusion flaw, which occurs when an application includes a file without properly validating the input, allowi...

CVE-2026-9231: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

WordPress WP Travel Engine plugin < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image vulnerability

Subscriber+ Arbitrary Media File Move via userprofileimage vulnerability discovered by marim00 in WordPress Plugin WP Travel Engine versions 6.8.1...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In the “basic” time-travel mode without =inf-cpu or =ext, we still encounter timer interrupts. These can occur at arbitrary times, for example, while inside the timerread function, which simpl...

CVE-2026-81796

Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...

CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3...