PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106294

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

PT-2026-106774

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayons store.php, causing the authorization dispatcher to resolve an...

PT-2026-106823

Name of the Vulnerable Software and Affected Versions @quasar/ssl-certificate versions prior to 2.1.0 @quasar/cli versions prior to 5.0.4 @quasar/app-vite versions prior to 3.3.0 Description The @quasar/ssl-certificate utility caches a combined private key and certificate PEM without applying...

PT-2026-106317

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

PT-2026-106467

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

Cisco ASA Authentication Bypass by Spoofing (CVE-2023-20256)

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

Cisco ASA Authentication Bypass by Spoofing (CVE-2023-20245)

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2021-41091

CVE-2021-41091 A bug in Moby Docker Engine allows unprivileged users to traverse directories and execute programs directly from the container on the host machine. If there is a suid program in the container, the user will be able to execute it as suid on the host machine. PoC In the container's...

CVE-2026-24061-setup

CVE-2026-24061 설정 이 저장소에는 CVE-2026-24061용 Docker 설정이 포함되어 있습니다. Docker를 설치했다면 다음을 수행하세요: 1. 이 저장소를 클론하세요. 2. 다음 명령어를 실행하세요: sudo docker build . --tag telnetd-auth-bypass 3. Docker 이미지가 빌드되면 다음 명령어로 컨테이너를 시작할 수 있습니다: sudo docker run -dt --rm --name test telnetd-auth-bypass 4. 완료되면 해킹할 준비가 된 취약한 실습...

CVE-2025-64446-Exploit

CVE-2025-64446-Exploit CVE-2025-64446 취약점을 이용한 fortiweb WAF 익스플로잇입니다. 이 익스플로잇을 사용하여 사용자와 비밀번호를 생성할 수 있습니다. 실행 방법? python3 exploitforti.py targets.txt python3 exploitforti.py 192.168.1.1 python3 exploitforti.py 192.168.1.1:8443 python3 exploitforti.py https://192.168.1.1:8443 결과 예시: 텔레그램:...

CVE-2026-11961

CVE-2026-11961 WordPress プラグイン User Registration & Membership に影響する CVE-2026-11961 の大量活用ツール。 特徴 プラグインのバージョン検出 単一ターゲットのサポート バッチターゲット処理 マルチスレッドサポート ランダムまたはカスタム認証情報 HTTP/HTTPS プロキシサポート リクエストタイムアウト設定 JSONL 出力 ログファイルサポート Telegram 通知 フォースモード --force 使用方法 ヘルプを表示 python3 mass.py -h 単一ターゲット python3 mass.p...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Deep-Dive In‑depth technical analysis of CVE‑2026‑41096, a critical heap overflow in Windows DNSAPI.dll enabling remote code execution via crafted DNS responses. Includes attack vectors, patch insights, and defensive guidance for security teams. Overview CVE‑2026‑41096 i...

CVE-2026-24061-POC

CVE-2026-24061 - telnetd 認証バイパス PoC telnetd の重大な認証バイパスにより、root としての RCE（リモートコード実行）につながる 2015年以降の、この脆弱性を含む telnetd バージョンを搭載したシステムに影響します 概要 この PoC は、11年間検出されずに telnetd に存在してきた重大な認証バイパス脆弱性 CVE-2026-24061 を実証します。この脆弱性は、telnetd のログインプロセスにおける USER 環境変数の不適切な処理に起因します。この脆弱性を導入した悪名高いコミットは こちら で確認できます。 要件...

CVE-2021-40223

CVE-2021-40223 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Stored XSS Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input on Security...

CVE-2026-77226

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

EUVD-2026-92791

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-105698

Langflow (versions 1.0.0 through 1.10.0) is vulnerable to cross-user flow access and unauthorized vertex execution due to a missing ownership check in deprecated handlers. Specifically, the POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} endpoints faile...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...