Cacti <=1.2.22 - Remote Command Injection

Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...

CVE-2024-50945

CVE-2024-50945 説明 SimplCommerceは、レビューシステムにおける壊れたアクセス制御の脆弱性の影響を受け、購入していない製品に対してレビューを投稿することを許可しています。 検出方法 攻撃者は、レビュー送信エンドポイントにリクエストを送信し、EntityIdを購入していない製品のIDに変更することで、この脆弱性を検出できます。レビューが正常に投稿された場合、ウェブサイトが壊れたアクセス制御の脆弱性に対して脆弱であることが確認されます。 テスト済み 230310c8d7a0408569b292c5a805c459d47a1d8f commit リンク...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 説明 このスクリプトは、CVE-2024-24919 （Checkpoint Security Gateway の不正な情報開示）の悪用を自動化します。 📌 特徴 ✅ 単一URL・一括URLのテスト ✅ 自動エクスプロイト ✅ シンプル＆高速 🛠️ 使用方法 このリポジトリをクローンしてスクリプトを実行します： git clone https://github.com/spider00009/CVE-2024-24919-POC.git cd CVE-2024-24919-POC python exploit.py -u...

Electrolink-FM-DAB-TV

Electrolink-FM-DAB-TV CVE-2025-51040用 Electrolink FM/DAB/TV 送信機 Web 管理システムの不正アクセスに関する脆弱性。Electrolink 500W、1kW、2kW 中電力 DAB 送信機 Web v01.09、v01.08、v01.07、および Display v1.4、v1.2 が影響を受けます。 説明 Electrolink FM/DAB/TV 送信機 Web 管理システムは不正アクセスに対して脆弱です。攻撃者は /FrameSetCore.html...

Anti-Tamper-Perturbation

🛡️ 無許可の個人画像生成に対する改ざん防止保護 ICCV 2025 論文の公式コード 📄 無許可の個人画像生成に対する改ざん防止保護 ⚙️ 環境構築 conda create --name ATP --file requirements.txt conda activate ATP 🔐 ATPの起動 1. データセット CelebA-HQ と VGGFace2 をダウンロードします。データセットへのリンクは CelebA-HQ、VGGFace2 から入手できます。認証モデルのトレーニングには、FFHQ もダウンロードする必要があります。 2. 認証モデルの重み とガイド用の マスク...

The vulnerability of the GlancesXMLRPCCHandler() and GlancesXMLRPCServer() classes in the glances/server.py file of the Glances monitoring tool’s application programming interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GlancesXMLRPCHandler and GlancesXMLRPCServer methods in the glances/server.py file of the Glances monitoring tool’s application programming interface is related to a deficiency in the source verification mechanism. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the MariaDB database management system, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the MariaDB database management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Podman software for managing and starting OCI containers lies in the insufficient protection of operational data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Podman software for managing and starting OCI containers is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the XRDP server, related to inconsistencies in response to incoming requests, allows attackers to gain unauthorized access to protected information.

The vulnerability of the XRDP server is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20261005-73-0099

The vulnerability in dotnet9.0 is related to a lack of source verification mechanism. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-106082

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/project id/join/pk/ uses permission classes = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

PT-2026-106241

Name of the Vulnerable Software and Affected Versions AMD Zynq™ UltraScale+ MPSoC affected versions not specified AMD RFSoC affected versions not specified Description Insufficient boundary validation in the USB boot mode implementation allows unbounded Device Firmware Upgrade DFU download reques...

ROS-20261005-73-0092

The vulnerability in dotnet10.0 is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20261005-73-0005

The vulnerability in rsync relates to incorrect restrictions on the path to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261005-73-0101

The vulnerability in dotnet10.0 is related to a lack of source verification mechanism. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Cryptanalysis of a Class of Ideal Secret Sharing Schemes Based on the CRT for Polynomial Rings

Based on the CRT for polynomial rings, Yang, Zhu, Fu and Xia ISIT 2026 proposed a compartmented secret sharing scheme for the compartmented access structure with lower bounds, claiming it can be ideal. We exhibit three families of unauthorized subsets that reconstruct the secret. The scheme is...

PT-2026-106200

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization. Recommendations Update to version 6.44.1...

CVE-2026-71299: Missing Authentication for Critical Function

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-105681: Improper Neutralization of Special Elements in Data Query Logic

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...