達煬科技｜WinMatrix3 Web套件 - Insecure Direct Object Reference

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.twcert.org.tw/tw/cp-132-10260-17932-1.html
• https://www.twcert.org.tw/newepaper/cp-151-10260-17932-3.html
• https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/2178992e-6020-49ce-94f3-8edfd7993d35/
• https://tp2rc.tanet.edu.tw/node/1110
• https://www.twcert.org.tw/en/cp-139-10265-b36e9-2.html
• https://www.openinfosec.com/zh/shareArticle/content/1200
• https://www.twcert.org.tw/tw/lp-132-1-2-60.html

Related Vulnerabilities

• PoCCVE-2026-26265: Discourse - Private User Field Disclosure via Directory Items IDOR
• PoCCVE-2026-81578: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct
• WordPress Directory Kit 插件敏感信息泄露漏洞(CVE-2025-13920)
• PoCCVE-2025-53887: Directus < 11.9.0 - Version Disclosure
• PoCCVE-2026-64849: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
• PoCCVE-2015-7501: Red Hat JBoss - Insecure Deserialization
• PoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
• PoCbentoml-open-redirect: BentoML v1.3.9 - Open Redirect
• PoCnodogsplash-lfi: Nodogsplash - Directory Traversal
• PoCuna-cms-rce: UNA CMS <= 14.0.0-RC4 - PHP Object Injection
• 英華達｜全家寶 Cloud - Insecure Direct Object Reference
• PoCCVE-2025-55746: Directus - Unauthenticated File Modification
• PoCCVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection