// 漏洞研究
為 AI 構建的網站與應用程式提供漏洞研究。
針對 AI 生成的 Web 應用、BaaS 堆疊、前端打包、認證與依賴項安全的漏洞的來源支持筆記。
Mbed TLS Double-Free Vulnerability (CVE-2021-44732)
CVE-2021-44732 affects older Mbed TLS releases in a session-handling error path. FixVibe repo scans can now flag affected version evidence in source and build metadata, while making clear that the scan did not run Mbed TLS, force out-of-memory behavior, or prove exploitation.
全部研究
52 篇文章
Missing Authentication in Moxa NPort Series Devices (CVE-2016-9369)
Moxa NPort serial device servers before vendor fixed firmware releases are associated with CVE-2016-9369. FixVibe can flag strong HTTP model and firmware-version evidence as a version-based advisory during verified active scans without attempting firmware updates, unauthenticated administrative actions, or exploit confirmation.
Schneider Electric Modicon M221 Authentication Replay Advisory (CVE-2018-7790)
FixVibe can flag public Modicon M221 HTTP product and firmware-version evidence associated with CVE-2018-7790 as a version-based advisory. The scan does not replay authentication, query industrial protocols, upload PLC programs, or prove unauthorized access.
Langflow CORS Misconfiguration Enables Account Takeover and RCE (CVE-2025-34291)
GitHub, NVD, and CISA describe CVE-2025-34291 as a critical Langflow CORS issue affecting versions 1.6.9 and earlier. FixVibe covers it with a verified-target check that combines Langflow version and fingerprint evidence with credentialed CORS header reflection, without authenticating, reading tokens, triggering refresh flows, or proving code execution.
PickleScan ZIP Archive Scan Bypass (CVE-2025-10156)
FixVibe can flag repositories that declare PickleScan versions before 0.0.31, which public advisories associate with a ZIP archive scan-bypass issue. The scanner reports dependency evidence, affected range, fixed version, confidence, and what was not verified; it does not run PickleScan, create corrupted archives, load models, or prove code execution.
Malware in @tanstack/arktype-adapter Exfiltrates Credentials (CVE-2026-45321)
The TanStack npm supply-chain compromise included @tanstack/arktype-adapter versions 1.166.12 and 1.166.15. These package versions contained embedded malware; teams should remove them, rebuild cached install environments, and rotate credentials if either version was installed.
Arbitrary Code Execution in NLTK via Zip Slip (CVE-2025-14009)
NLTK versions through 3.9.2 are associated with CVE-2025-14009, a downloader Zip Slip advisory that can lead to arbitrary code execution when malicious or compromised packages are extracted. Upgrade to 3.9.3 or newer.
Apache Tomcat Sensitive Information Disclosure (CVE-2021-25122)
Apache Tomcat h2c request handling in affected 8.5.x, 9.0.x, and 10.0.x release lines can mix request headers and limited body data between users. Upgrade to 8.5.63, 9.0.43, 10.0.2, or newer for the release line in use.
Information Disclosure via Undocumented TRACK Method in Microsoft IIS 5.0
CVE-2003-1567 covers Microsoft IIS 5.0 TRACK behavior that can echo request content. FixVibe now reports this as a verified active-scan finding when target-specific, non-sensitive evidence shows legacy TRACK echo behavior, while clearly separating that evidence from proof of cookie theft or compromise.
Stack-Based Buffer Overflow in Orpak SiteOmat CGI Components (CVE-2017-14854)
FixVibe verified active scans can now identify strong Orpak SiteOmat BOS product and version evidence associated with CVE-2017-14854. Findings are reported as version-based advisories: FixVibe verifies the exposed SiteOmat version, not CGI crash behavior or code execution.
Microsoft ATL COM Initialization Advisory (CVE-2009-2493)
Microsoft ATL components and controls built with affected ATL headers can be exposed to CVE-2009-2493 under COM initialization conditions. FixVibe now treats this as covered by its repo source/build advisory for legacy Visual C++ ATL projects, without claiming build-machine patch state, deployed ActiveX or COM exposure, or live code-execution proof.
Apache Tomcat EncryptInterceptor Bypass (CVE-2026-34486)
FixVibe covers CVE-2026-34486 as a repo-scan version advisory for exact Apache Tomcat releases, while keeping clustering and plaintext-disclosure conditions explicit.
Information Disclosure in Microsoft Visual Studio ATL (CVE-2009-2495)
CVE-2009-2495 is an information-disclosure issue in Microsoft ATL-built components and controls. FixVibe covers it with MS09-035 repo scan evidence for legacy Visual C++ ATL build metadata, reported as source/build advisory context rather than exploit confirmation.
Critical Input Validation Vulnerability in PowerLogic EGX Gateways (CVE-2021-22765)
FixVibe already covers CVE-2021-22765 through the shipped PowerLogic EGX verified-active HTTP product/firmware advisory check. The detector flags public EGX100 firmware or EGX300 product evidence for the shared Schneider advisory family without sending crafted HTTP packets, authenticating, querying industrial protocols, crash-testing, or proving exploitability.
Traffic Interception in Kubernetes via ExternalIPs (CVE-2020-8554)
FixVibe repo scans can flag Kubernetes Service manifests that explicitly set non-empty spec.externalIPs as static source/config hardening evidence for CVE-2020-8554. The check does not inspect live clusters, RBAC, admission policy, deployed Services, or traffic paths.
Authentication Bypass in SiteOmat BOS (CVE-2017-14728)
SiteOmat BOS versions before 6.4.414.084 are associated with CVE-2017-14728. FixVibe reports strong public HTTP product/version evidence during verified active scans without attempting default credentials, SSH login, broad port scans, state-changing management actions, or unauthorized access.
Critical Remote Code Execution in PowerLogic EGX Gateways (CVE-2021-22768)
CVE-2021-22768 is an improper input validation issue in Schneider Electric PowerLogic EGX100 and EGX300 gateways. FixVibe covers the public HTTP product and firmware evidence for the affected range without sending crafted packets or attempting exploitation.
Sweet32: Birthday Attack Vulnerability in 64-bit Block Ciphers (CVE-2016-2183)
Sweet32 (CVE-2016-2183) affects encrypted sessions that negotiate DES or Triple DES (3DES) 64-bit block ciphers. The practical risk depends on attacker traffic visibility and enough data under long-lived session conditions, but public TLS endpoints should not negotiate these ciphers.
幽靈內容 API 中的 SQL 注入 (CVE-2026-26980) ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 Ghost 版本 3.24.0 至 6.19.0 容易受到內容 API (CVE-2026-26980) 中關鍵 SQL 注入的攻擊，從而允許未經身份驗證的資料存取。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 Ghost 版本 3.24.0 到 6.19.0 在內容 CVE-2026-26980 中包含嚴重的 SQL 注入漏洞。這使得未經身份驗證的攻擊者可以執行任意 SQL 命令，從而可能導致資料外洩或未經授權的修改。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 影響 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 Ghost 版本 3.24.0 到 6.19.0 容易受到內容 ZXCVFIXVIBETOKEN4ZXCV CVE-2026-26980 嚴重 SQL 注入漏洞的影響。未經身份驗證的攻擊者可以利用此缺陷對底層資料庫 API 執行任意 SQL 命令。成功利用漏洞可能會導致敏感使用者資料外洩或未經授權修改網站內容 ZXCVFIXVIBETOKEN2ZXCV。此漏洞的 CVSS 評分為 9.4，反映了其嚴重程度 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 根本原因 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 這個問題源自於 Ghost 內容 ZXCVFIXVIBETOKEN3ZXCV CVE-2026-26980 的輸入驗證不當。具體來說，應用程式無法在將使用者提供的資料合併到 SQL 查詢 API 之前正確清理使用者提供的資料。這允許攻擊者透過注入惡意 SQL 片段 ZXCVFIXVIBETOKEN2ZXCV 來操縱查詢結構。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 ## 受影響的版本 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 從 **3.24.0** 到 **6.19.0** 的 Ghost 版本容易受到此問題 CVE-2026-26980API 的影響。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 ## 修復 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 管理員應將其 Ghost 安裝升級至版本 **6.19.1** 或更高版本，以解決此漏洞 CVE-2026-26980。此版本包含正確中和內容 ZXCVFIXVIBETOKEN2ZXCV 查詢 API 中使用的輸入的補丁。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 ## 漏洞識別 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 識別此漏洞需要根據受影響的範圍（3.24.0 至 6.19.0）API 驗證 CVE-2026-26980 軟體套件的安裝版本。運行這些版本的系統被認為有透過內容 ZXCVFIXVIBETOKEN3ZXCV ZXCVFIXVIBETOKEN2ZXCV 進行 SQL 注入的高風險。
Ghost versions 3.24.0 through 6.19.0 contain a critical SQL injection vulnerability in the Content API. This allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to data exfiltration or unauthorized modifications.
透過模板標籤在 SPIP 中遠端執行程式碼 (CVE-2016-7998) ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 SPIP 3.1.2 及更早版本容易透過上傳的 HTML 檔案中的惡意範本標籤受到遠端執行程式碼的攻擊。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 SPIP 版本 3.1.2 及更早版本在範本編輯器中包含漏洞。經過驗證的攻擊者可以上傳帶有精心設計的 INCLUDE 或 INCLURE 標記的 HTML 文件，以在伺服器上執行任意 PHP 程式碼。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 影響 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 經過驗證的攻擊者可以在底層 Web 伺服器 CVE-2016-7998 上執行任意 PHP 程式碼。這允許完整的系統妥協，包括資料外洩、網站內容修改以及託管環境 ZXCVFIXVIBETOKEN1ZXCV 內的橫向移動。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 根本原因 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 此漏洞存在於 SPIP 模板編輯器和編譯器組件 ZXCVFIXVIBETOKEN3ZXCV 中。處理上傳的檔案 ZXCVFIXVIBETOKEN4ZXCV 時，系統無法正確驗證或清除特定範本標籤內的輸入。具體來說，編譯器錯誤地處理 HTML 檔案 ZXCVFIXVIBETOKEN5ZXCV 中精心製作的 CVE-2016-7998 或 ZXCVFIXVIBETOKEN1ZXCV 標籤。當攻擊者透過ZXCVFIXVIBETOKEN2ZXCV操作存取這些上傳的檔案時，惡意標籤將會被處理，導致PHP程式碼執行ZXCVFIXVIBETOKEN6ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 ## 受影響的版本 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 * SPIP 版本 3.1.2 和所有先前版本 CVE-2016-7998。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 ## 修復 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 將 SPIP 更新至 3.1.2 以上版本以解決此漏洞 CVE-2016-7998。確保檔案上傳權限嚴格限制於受信任的管理用戶，並且上傳的檔案不會儲存在 Web 伺服器可以將其作為腳本 ZXCVFIXVIBETOKEN1ZXCV 執行的目錄中。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 ## CVE-2016-7998 如何測試它 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 CVE-2016-7998主要透過兩種方法偵測此漏洞： ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 1. **被動指紋辨識：** 透過分析HTTP響應頭或HTML來源中的特定元標記，ZXCVFIXVIBETOKEN2ZXCV可以識別SPIP CVE-2016-7998的運行版本。如果版本為3.1.2或更低，則會觸發高嚴重性警報ZXCVFIXVIBETOKEN1ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 2. **儲存庫掃描：** 對於連接 ZXCVFIXVIBETOKEN2ZXCV 儲存庫的用戶，ZXCVFIXVIBETOKEN1ZXCV 的儲存庫掃描器可以檢查 SPIP 原始程式碼中的依賴檔案或版本定義常數，以識別易受攻擊的安裝 CVE-2016-7998。
SPIP versions 3.1.2 and earlier contain a vulnerability in the template composer. Authenticated attackers can upload HTML files with crafted INCLUDE or INCLURE tags to execute arbitrary PHP code on the server.