CVE-2026-91088

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2026-91088

GPAC is affected by a heap-based buffer overflow in the gf_url_concatenate_ex function located in utils/url.c (URL Handler component), affecting versions up to commit f1219cde. The flaw is triggered locally with low privileges and passive user interaction, leading to low impact on confidentiality...

CVE-2026-91088 GPAC URL url.c gf_url_concatenate_ex heap-based overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

EUVD-2026-78303

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable o...

CVE-2021-43798

CVE-2021-43798 1. 概述 Grafana 是一个支持数据监控和管理功能的开源平台，在以下版本中存在路径遍历漏洞，可通过 ../ 等特殊字符操纵文件路径。 8.0.0 及以上，但低于 8.0.7 8.1.0 及以上，但低于 8.1.8 8.2.0 及以上，但低于 8.2.7 8.3.0 漏洞路径为 /public/plugins//，其中 是已安装插件的 ID。可通过以下资料确认脆弱路径。 https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p 2. 配置和运行漏洞环境 2.1...

CVE-2025-70828

CVE-2025-70828 摘要 在 Datart v1.0.0-rc.3 中发现了一个任意文件读取漏洞。该应用程序在数据源配置期间未能正确验证 JDBC 连接 URL。 漏洞详情 漏洞类型： 不当输入验证（CWE-20）/ 任意文件读取 受影响版本： Datart v1.0.0-rc.3 严重程度： 高危（可能导致敏感信息泄露） 描述 该漏洞存在于数据源配置模块中。应用程序未严格清理 JDBC 配置中的 url 参数。具有数据源配置权限的远程攻击者可以向 JDBC URL 注入恶意参数（特别是 allowLoadLocalInfile=true）。 通过将 JDBC...

EUVD-2026-78272

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2023-40037

CVE-2023-40037：Apache NiFi 中 JDBC 和 JNDI 连接 URL 的验证不完整 Apache NiFi 1.21.0 至 1.23.0 在多个处理器和控制器服务中支持 JDBC 和 JNDI JMS 访问，其连接 URL 验证无法针对精心构造的输入提供充分保护。已通过身份验证并获得授权的用户可以使用自定义输入格式绕过连接 URL 验证。修复方案增强了连接 URL 验证，并引入了对其它相关属性的验证。建议升级到 Apache NiFi 1.23.1 以进行缓解。 供应商披露： 此漏洞的供应商披露和修复可在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验...

CVE-2021-39165

CVE-2021-39165 POC en Python3 para CVE-2021-39165 en CachetHQ Uso En primer lugar, debes instalar las dependencias: root@kitploit: pip3 install -r requirements.txt Si quieres comprobar si la URL de la víctima es vulnerable o no, puedes ejecutar: root@kitploit: python3 exploit.py -u -c Si quieres...

CVE-2024-4577

CVE-2024-4577：PHP CGI 配置中的严重漏洞 PHP 的 CGI 模式存在一个严重的安全漏洞，攻击者可以通过操控 URL 参数来运行任意命令。 受影响版本 Windows 上运行 php-cgi 的 PHP 7.4.29 之前及 8.0.19 之前的版本。 攻击方法 攻击者可以通过向 PHP CGI 脚本发送特制请求来利用此漏洞。这些请求会注入恶意参数，从而允许执行任意命令。这可能导致系统完全沦陷。 使用说明 先决条件 在运行脚本之前，请确保系统中已安装 Python 3。此外，你需要 requests 库来处理 HTTP 请求。 安装依赖 你可以使用 pip...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic 未授权绕过 RCE CVE-2020-14882 Oracle Weblogic 未授权绕过 RCE 测试脚本 支持 Python3 请求 root@kitploit: POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/86.0.4240.111 Safari/537.3...

onedrive_user_enum

onedriveuserenum v2.10 枚举有效的 OneDrive 用户 有关枚举技术和 OneDrive 枚举的完整说明，请参阅以下博客： https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ 如果你在寻找旧的、非数据库版本的 OneDrive Enum，可以在这里找到：https://github.com/nyxgeek/simplescanners 2.10 版新特性： 远程 MySQL 数据库日志记录选项 -- 记录到远程数据库 PAUSEFILE -- 如果存在 pausefile...

CVE-2026-91750

WeKnora before 0.7.0 (developed by Tencent) is vulnerable to SSRF via unvalidated HTTP redirects. The flaw resides in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, which fails to re-validate redirect targets after the initial SSRF check when downloading documents from user-supplied...

EUVD-2026-78208

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

EUVD-2026-78169

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

RockyLinux 8 : git-lfs (RLSA-2026:67161)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

PT-2026-91771

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-91146

Takahe versions through 0.11.0 fail to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote attackers to inject javascript: links that execute in the instance origin when a user clicks them, enabling session hijacking or impersonation of viewe...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.

Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...