CVE-2021-36750

CVE-2021-36749 정보 - Druid 수집 시스템에서 InputSource는 특정 데이터 소스로부터 데이터를 읽는 데 사용됩니다. 그러나 HTTP InputSource는 인증된 사용자가 Druid 서버 프로세스의 권한으로 로컬 파일 시스템과 같이 의도하지 않은 다른 소스의 데이터를 읽을 수 있도록 허용합니다. 사용자가 Druid에 직접 액세스하는 경우 Druid에서 동일한 수준의 액세스를 허용하는 Local InputSource도 제공하므로 이는 권한 상승이 아닙니다. 그러나 사용자가 HTTP InputSource는...

XWiki - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

XWiki >= 6.2-milestone-1 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

CVE-2022-28117

CVE-2022-28117 Navigate CMS = 2.9.4 - 서버 측 요청 위조 인증됨 설명 Navigate CMS v2.9.4의 feedparser 클래스에서 발생하는 서버 측 요청 위조SSRF 취약점으로 인해 원격 공격자가 feed 매개변수에 임의의 URL을 주입하여 애플리케이션이 임의의 요청을 보내도록 강제할 수 있습니다. 참고 자료 https://nvd.nist.gov/vuln/detail/CVE-2022-28117 https://www.youtube.com/watch?v=4kHW95CMfD0...

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover

CVE-2025-59382: QNAP 비밀번호 재설정을 통한 계정 탈취 인증되지 않은 공격자가 제어하는 비밀번호 재설정 URL이 /cgi-bin/resetpassword.cgi에 존재합니다. 실험실 환경에서 QuTScloud c5.2.4.3041 build 20250211에 대해 테스트했습니다. QNAP은 이후 권고 QSA-26-10에서 이를 CVE-2025-59382로 발표했습니다. 요약 로컬 네트워크에 접근 가능하거나 노출된 NAS 관리 인터페이스에 접근할 수 있는 인증되지 않은 공격자는...

cve-2025-24514

🔥 CVE-2025-24514 원격 취약점 점검 PoC 이 스크립트는 CVE-2025-24514 취약점ingress-nginx의 auth-url 주입을 통한 NGINX 설정 조작 및 RCE 가능성에 대해 원격으로 점검 할 수 있는 Python 기반 PoC입니다. 🧠 취약점 개요 CVE-2025-24514 는 Kubernetes Ingress Controller 중 ingress-nginx에서 nginx.ingress.kubernetes.io/auth-url 어노테이션을 통해 NGINX 설정이 의도치 않게 주입 되는 취약점입니다...

CVE-2024-4041

CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%22alertdocument.domain%22%20x%3D%22 3. 管理バーでYoastメニューを開き、Get Yoast SEO Premium にカーソルを合わせるかクリックします。 4. 注入されたイベントハンドラonmouseoverからJavaScriptが実行され、反射型XSSが確認されます。...

IngressNightterror

IngressNightterror CVE-2025-1974 개요 이 저장소는 IngressNightmare 취약점에 대한 제 연구입니다. 취약한 Ingress 배포 파일, 익스플로잇 자체, 공유 객체 페이로드를 포함하고 있습니다. CVE CVE 인덱스 목록: CVE-2025-1974 - 근본 취약점 CVE-2025-24514 - auth-url 어노테이션 주입 CVE-2025-1097 - auth-tls-match-cn 어노테이션 주입 CVE-2025-1098 - 이미지 UID 남용 참고 자료 몇 가지 참고 자료: 원본...

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-85230

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230

CVE-2026-85230 is a persistent unsafe URL injection vulnerability in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time, not when saved, allowing an authenticated user to persist arbitrary URLs—including javascript: scheme values—through either...

EUVD-2026-70503

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

CVE-2026-84662

Jenkins LDAP Plugin (ldap) versions 807.809.vd3a_4e5e4ec98 and earlier suffer from an improper access control flaw that enables Server-Side Request Forgery (SSRF) . The plugin's use of Stapler's @DataBoundConstructor annotation on a constructor that connects to a specified URL allows attackers ca...

CVE-2026-82681

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

Linux Distros Unpatched Vulnerability : CVE-2026-82249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carria...

EUVD-2026-67841

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

EUVD-2026-65518

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL

A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...