180796 matches found
WP Cerber < 8.9.3 - Broken Access Control
WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. id: CVE-2021-37598 info: name: WP Cerber 8.9.3 - Broken Acces...
Astro - Unauthorized Third-Party Image Access
Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...
WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may...
Ctirix_RCE-CVE-2019-19781
CtirixRCE-CVE-2019-19781 Citrix ADC RCE cve-2019-19781 Video Follow us Vulnmachines YouTube Twitter Facebook...
Vulnerability-Disclosures
Mandiant 漏洞披露 本仓库详细列出了 Mandiant 披露的漏洞。这些漏洞通过内部研究、红队评估或在野利用被发现。可能提供也可能不提供概念验证（PoC）。 以下 许可证/许可 适用于本 Mandiant 仓库： 1. CC BY-SA 4.0 - 适用于与 CVE 相关的信息（不包括源代码，如 PoC） 2. MIT - 适用于所提供的 CVE 信息中包含的源代码 Mandiant 根据 Google 漏洞披露政策 协调和处理漏洞披露。 Mandiant CNA Mandiant 的 CVE 编号授权机构（CNA）范围：Mandiant 代码中的漏洞，以及由 Mandiant...
pub
❤ 成为英雄，打赏一杯 🍺 🙂 ⟶ Ƀ : 1AZMeGVfCBbYwVYyG9s79pJDyocTZgiApa | Ξth : 0x438B38E30eF117C15fBfF833f9C2c70182925815 由 tintinweb 披露的漏洞利用 PoCs 与工具。 公开 root@kitploit: police line - do not cross ==== police line - do not cross ==== police line - do not cross ==== ==== police line - do not cross ==== police...
securitylab
GitHub Security Lab 这是 GitHub Security Lab 的主要 Git 仓库。 我们将其用于以下主要目的： 在我们的 docs 中与社区分享关于安全研究和漏洞披露的最佳实践。 我们使用 此仓库的 issues 来跟踪 CodeQL 赏金请求。 我们用它来发布一些概念验证漏洞利用（在漏洞修复后）。这些 PoC 可以在 SecurityExploits 子目录中找到。 CodeQL 查询示例，可以在 CodeQLQueries 子目录中找到。 CodeQL 资源 这部分是你们的！ 你想与社区分享一个很酷的 CodeQL...
security-research
安全研究 本项目收录了 Google 研究中所发现的安全公告及其 配套的概念验证（PoC）代码，这些研究影响 非 Google 所属的代码。 我们相信漏洞披露需要双方共同努力。供应商 和研究人员都必须以负责任的方式行事。因此，Google 遵循 90 天披露期限：我们会立即将漏洞告知供应商， 并在 90 天后将详细信息公之于众，供防御社区 参考；若供应商更早发布修复程序，则可提前披露。 您可以在此处查阅我们的完整政策： https://www.google.com/about/appsecurity/. 安全公告 漏洞披露均以安全公告的形式呈现，可在 安全公告 页面中浏览。 许可证与专利...
CVEs
CVEs 这些是我发现并通过 CVE 项目披露的漏洞。...
NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure
NETGEAR DGN2200 / DGND3700 is susceptible to a vulnerability within the page 'BSWcxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface. id:...
BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files. id: CVE-2019-25246 info: name: BEWARD...
Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API. id: CVE-2018-19365 info: name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal author: 0xAkoko severity: critical...
owasp-threat-dragon-desktop
OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...
advisories
Advisories Security advisories from Kelly Kaoudis @kaoudis and friends. In general, I'll publish here either after the vendor has patched, or after 90 days from vulnerability discovery. Happy reading! Advisories are numbered in discovery order & by year; discovery enumeration starts at 0...
PT-2026-86568
Name of the Vulnerable Software and Affected Versions D-Link DIR-895L version A1 102b07 Description A remote command injection issue exists within the udhcpcd component. The flaw is located in the sendACK function of the udhcpcd/serverpacket.c file. An attacker can execute arbitrary commands...
GHSA-9J23-GV58-CFXH vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-72805
creationtimestamp| type| source ---|---|--- 2026-09-04 00:35:19+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-67x2-mq63-v9vm 2026-09-04 05:31:58+00:00| seen| https://gist.github.com/alon710/4b6d07ad637cc3c13ae34977d7426539...
Disclosures
漏洞披露 本仓库包含我的漏洞报告，这些报告不受保密协议（NDA）约束，也不受 VRP 服务条款的限制。 目录 Fancy Product Designer Microsoft Xfinity...