64 matches found
bug-reaper
BugReaper 结构化 web2 漏洞赏金 AI 技能 — 18 类漏洞、4 个漏洞赏金平台、零 AI 垃圾内容。兼容 OpenClaw、Cursor、Claude Code、Antigravity 和 Windsurf。 BugReaper 是一款 Agent Skill，可将任何兼容的 AI 代理转变为训练有素的 web2 漏洞赏金猎人。它强制执行基于证据的验证，模拟 HackerOne、Bugcrowd、Intigriti 和 YesWeHack 的真实分类流程，并将低严重性漏洞串联为严重发现。每条发现都必须具备可运行的 PoC 才会被报告。 代理兼容性 代理| 支持情况|...
CVE-2026-75334
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...
PT-2026-82264
Name of the Vulnerable Software and Affected Versions smart-web2 version 1.3.1 Description The report module in the backend allows arbitrary SQL execution. This occurs because the sqlResource.sql parameter, processed through the ReportController.save interface and stored in the t report sql...
EUVD-2026-66700
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...
CVE-2026-75334
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...
CVE-2026-75334: Improper Neutralization of Special Elements used in an SQL Command
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...
CVE-2026-75334
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution . The vulnerability exists because the sqlResource.sql parameter, submitted via the ReportController.save() interface, is stored in the t_report_sql_resource table and subsequently embedded directly int...
CVE-2026-75334
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...
CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function
The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network acces...
CVE-2026-61884
Technical details are not publicly available in the provided documents. Monitor for updates from NVD/CVE and trusted advisories to confirm affected versions, root cause specifics, and remediation.
CVE-2026-55985 Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...
CVE-2026-55985
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...
CVE-2026-61884: Missing Authentication for Critical Function
The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network acces...
CVE-2026-55985: Cleartext Storage of Sensitive Information
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...
EUVD-2020-17100
Malware in sbrugna...
EUVD-2015-1074
Malware in sbrugna...
Malicious code in pool-web2 (npm)
The package pool-web2 was found to contain malicious code...
MAL-2025-29507 Malicious code in pool-web2 (npm)
The package pool-web2 was found to contain malicious code...