References https://www.twcert.org.tw/tw/cp-132-10938-97ddd-1.html https://www.twcert.org.tw/tw/lp-132-1.html
Related VulnerabilitiesPoCCVE-2026-26265: Discourse - Private User Field Disclosure via Directory Items IDORPoCCVE-2026-81578: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct畅捷通 T+ POSSyncService.asmx 接口SQL注入漏洞WordPress Directory Kit 插件敏感信息泄露漏洞(CVE-2025-13920)PoCCVE-2025-53887: Directus < 11.9.0 - Version DisclosurePoCCVE-2026-64849: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect BypassPoCCVE-2015-7501: Red Hat JBoss - Insecure DeserializationPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCbentoml-open-redirect: BentoML v1.3.9 - Open RedirectPoCmonitorr-file-upload: Monitorr Services Configuration - Arbitrary File UploadPoCnodogsplash-lfi: Nodogsplash - Directory TraversalPoCuna-cms-rce: UNA CMS <= 14.0.0-RC4 - PHP Object Injection金和OA /c6/JHSoft.Web.CostControl/Decompose/AjaxForCenterBudgetDecompose.ashx SQL 注入漏洞