CVE-2026-79731

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this flaw, resulting in information exposure . ...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core 插件 选项 示例： root@kitploit: python CVE-2025-49388.py -u http://127.0.0.1/wordpress 主要选项： 注意： 如果省略用户名或电子邮件，每次运行时将生成随机值以避免重复错误。 📝 示例输出 root@kitploit: Nxploited INFO 目标: http://target/wp-admin/admin-ajax.php Nxploited INFO 开始尝试利用... Nxploited SUCCESS...

CVE-2025-60654

CVE-2025-60654 - 广告描述中的存储型跨站脚本（XSS） | ---|--- 研究人员| DotAdrien 严重程度| 7.2 高 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 软件| Script Pag 描述 广告描述字段存在存储型跨站脚本（XSS）漏洞。尽管设置了一些安全过滤器，但使用标准 HTML 标签即可轻松绕过。例如，使用 可使攻击者在查看特定页面的任意用户浏览器中执行 JavaScript。...

CVE-2026-79950

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure...

CVE-2026-79950

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 are affected by a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote network access could exploit this flaw to achieve information exposure ....

EUVD-2026-74953

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure...

citrix-cve-2021-22941-lab

⚠️ 免责声明 这是一个模拟 CVE-2021-22941 漏洞的测试环境。该模拟服务器复现了实际的易受攻击行为，即 Upload.aspx 端点无需认证即可访问，并返回 LocalFile GUID 响应，正如官方 CVE 和漏洞利用仓库中所记录的那样。 为什么使用模拟环境？ Citrix ShareFile Storage Zones Controller 是专有企业软件 搭建真实的易受攻击实例需要授权软件和复杂的基础设施 此模拟准确再现了 CVE 中描述的访问控制失效行为...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC 工具包 — CVE-2026-75650 Magento 零日漏洞 · Adobe Commerce 零日漏洞 · CVE-2026-75650 · APSB26-146 · VULN-39341 · 未认证 RCE · Magento 恶意软件 · Magento 后门清除 · Magento 2.4.9 漏洞 · Rust 植入程序 · GraphQL styles 注入 · PHP Web Shell 社区失陷指标（IOC）、失陷扫描器以及缓解/修补指南，针对 StyleSmuggler （CVE-2026-75650 ）——由 Sansec 于...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

EUVD-2026-74952

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775

CVE-2026-86775 affects the knowns npm package (versions ≤ 0.29.1) with a path traversal vulnerability in the Document API. The root cause lies in cleanDocPath() in internal/server/routes/docs.go, which strips leading/trailing slashes and the .md suffix but fails to neutralize ../ sequences, and i...

EUVD-2026-74933

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters, and LoginCon...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

EUVD-2026-74910

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...

CVE-2026-86199

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. An unauthenticated player can trigger an uninitialized property access error that crashes the server , resulting in a denial of service. The issue is resolved in version 5.43....

CVE-2026-86199 PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server...