Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

bluesnoop

bluesnoop 一个使用 Python 和 Bleak 库的简单蓝牙低功耗（BLE）嗅探器 功能 识别附近设备的 UUID 和名称 持久跟踪设备的首次和最后一次出现 翻译晦涩的型号 ID 导出情报以供外部分析 演示图库 定时嗅探 --- 无限嗅探 快速开始 授予蓝牙权限 如果你使用的是 iTerm2，你需要确保终端本身拥有蓝牙权限。 打开系统设置（或系统偏好设置）。 前往 Privacy & Security Bluetooth 并授予 iTerm2 访问权限 。 root@kitploit: python -m venv .venv source .venv/bin/activat...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: 对 https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py 的重新实现 使用 UUID 作为所请求文件名的一部分，以避免远程服务器在首次路径遍历利用后崩溃。 run.py / shell.py: 基于 podman 的包装器，用于运行本地容器...

bluffy

Bluffy Convierte shellcode en ✨ diferentes ✨ formatos! Bluffy es una utilidad que se utilizó en experimentos para evadir productos antivirus de forma estática formateando shellcode en formatos de datos de apariencia realista. Herramientas de prueba de concepto, como NinjaUUIDRunner de 0xBoku y...

CVE-2025-22828

CVE-2025-22828 📜 描述 Apache CloudStack 4.16.0 及更高版本存在一个访问控制缺陷，允许知道资源 UUID 的用户读取或添加他们无权访问的资源上的评论（注释）。UUID 可能会在应用程序的各个部分暴露，例如当用户最初有权访问某个资源，但因管理限制而后来失去访问权限时。 🔍 漏洞详情 类型: 访问控制缺陷 影响: 未经授权访问注释及潜在敏感数据 受影响版本: 4.16.0 及更高版本 CWE: 向未授权行为者暴露敏感信息 CWE-200 🎬 演示视频 未经授权访问注释（listAnnotations 命令） 未经授权添加注释（addAnnotation...

CVE-2019-16113-Dockerfile

Bludit目录穿越漏洞（CVE-2019--16113） Bludit-3.9.2 是轻量级 CMS，只需要 LAMP 环境便可运行。在图片上传时，Bludit检查文件后缀名后没有及时删除文件，攻击者还可以通过控制uuid参数实现目录穿越。具体参考 漏洞环境 执行如下命令编译镜像并启动Bludit容器 root@kitploit: cd Docker sudo docker build -t bludit:cve . 编译镜像 sudo docker run --name bludit -p 8000:80 -d bludit:cve 启动容器，服务在8000端口...

RDL-detect

Remote Desktop Licensing 服务排查 参考https://github.com/fortra/impacket/blob/master/examples/rpcdump.py 通过MSRPC枚举开放服务，根据UUID: 3d267954-eeb7-11d1-b94e-00c04fa3080d判断是否包含Terminal Server Licensing 用法：python3 rdl-detect.py 目标IP...

PT-2026-90431

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs uuid add file failure When nfs uuid add file races with nfs uuid put tearing down uuid-net, it returns -ENXIO without publishing nfl-nfs uuid via rcu assign pointer. nfs open local fh then enters...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Descripción general Este repositorio contiene la Prueba de Concepto PoC para CVE-2026-24134 , una vulnerabilidad de Autorización Rota a Nivel de Objeto BOLA en StudioCMS. Contenido cve202624134poc.py - Script de explotación en Python Requisitos previos StudioCMS=0.1.1...

CVE-2025-71417

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

CVE-2026-55255-Lab

CVE-2026-55255 - Langflow 中的 /api/v1/responses IDOR 漏洞 执行摘要 此存储库包含一个本地 Docker 实验室，用于重现和验证 CVE-2026-55255，这是一个影响 Langflow 的 OpenAI 兼容 Responses API 的不安全直接对象引用 IDOR 漏洞。 Langflow 是一个用于构建和部署人工智能驱动的代理和工作流的开源平台。该漏洞行为影响 /api/v1/responses 端点，在该端点上，经过身份验证的攻击者可以提供另一个用户的流 UUID 作为 model 值，从而导致 Langflow...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86451

MISP versions ≤2.5.45 contain an insecure direct object reference (IDOR) in EventGraphTool::get_reference_data(). Authenticated users could retrieve object-reference records by UUID without the system verifying that the requester had access to the parent object , allowing retrieval of reference d...

EUVD-2026-72396

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

EUVD-2026-70973

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...