Authentication Bypass｜多步骤找回密码的信任模型错位：step1 验 A 号、step2 绑 B 号、step3 改 C 的密码

# 多步骤找回密码：步骤间主体不一致 + 响应篡改

## 业务流程（状态机）
“`
step1 验证手机

IDOR / BOLA｜收据页多参数联合校验失效：codeId 可用 orderId 自证导致越权读取订单（IDOR）

# 收据页多参数联合校验失效（orderId + codeId）

## 业务流程
下单 → 收到收据链接 → 打开收据查看订单详

Authorization Bypass｜projectdiscovery/nuclei-templates :: Add CVE-2026-18315 vulnerability

Add CVE-2026-18315 vulnerability details (#17445) CVE-2026-18315 details the

Container / Infrastructure Security｜Introducing Internal Network Scanning: see your network the way an att

Most breaches don’t begin with a zero-day but with something ordinary l

Command Injection / RCE｜Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch B

Before we begin, yes – it’s confusing. There are more vulnerabili

Authentication Bypass｜High Signal Detection and Exploitation of Ivanti’s Pulse Connect Secur

High Signal Detection and Exploitation of Ivanti’s Pulse Connect Secure

REST API｜Leaking File Contents with a Blind File Oracle in Flarum

Introduction Flarum is a free, open source PHP-based forum software used for

Command Injection / RCE｜Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command

God damn it, we’re back in the room again. Yes, that sound in your ears

Command Injection / RCE｜Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-20

Part 1 of this week’s saga can be found here.This research is a glimpse

File Upload｜RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)

RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)（来源未提供摘要）<