更新: 421 个文件 - 2026-03-17 18:30:02
这个提交包含在：
hao
@@ -5,14 +5,14 @@
|
||||
- 系统 ID: `nextjs`
|
||||
- 分类: `frameworks`
|
||||
- 覆盖策略: `history-full`
|
||||
- 总案例数: `26`
|
||||
- 近 30 天新增/更新: `5`
|
||||
- 重点 Markdown 案例数: `26`
|
||||
- 已实证(真实版本): `0`
|
||||
- 总案例数: `24`
|
||||
- 近 30 天新增/更新: `3`
|
||||
- 重点 Markdown 案例数: `24`
|
||||
- 已实证(真实版本): `1`
|
||||
- 已实证(synthetic): `0`
|
||||
- 阻塞数: `0`
|
||||
- 待人工/缺浏览器证据: `26`
|
||||
- 最近渲染时间: `2026-03-17T12:57:12+00:00`
|
||||
- 待人工/缺浏览器证据: `23`
|
||||
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
|
||||
|
||||
## 目标约束
|
||||
|
||||
@@ -47,14 +47,12 @@
|
||||
| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
|
||||
| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
|
||||
| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
|
||||
| Authorization Bypass in Next.js Middleware | `low` | `generated` | `triage-manual` | `real` | `official` | `2026-03-04T15:06:29.993197Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md) |
|
||||
| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
|
||||
| Next.js authorization bypass vulnerability | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
|
||||
| Next.js authorization bypass vulnerability | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
|
||||
| Denial of Service condition in Next.js image optimization | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
|
||||
| Next.js Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
|
||||
| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
|
||||
| Unexpected server crash in Next.js. | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
|
||||
| XSS in Image Optimization API for Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
|
||||
| Open Redirect in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
|
||||
| Open Redirect in Next.js versions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:14:13.665535Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md) |
|
||||
| Directory Traversal in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |
|
||||
|
||||
@@ -8,10 +8,10 @@ updated_date: "2026-03-13T22:14:13.665535Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
verification_status: "triage-manual"
|
||||
verification_mode: "synthetic"
|
||||
artifact_mode: "synthetic"
|
||||
last_run_id: ""
|
||||
verification_status: "verified-real"
|
||||
verification_mode: "real"
|
||||
artifact_mode: "local-fixture"
|
||||
last_run_id: "nextjs-nextjs--CVE-2020-15242-20260318012830"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-x56p
|
||||
|
||||
## 本地实证状态
|
||||
|
||||
- 实证状态: `triage-manual`
|
||||
- 实证方式: `synthetic`
|
||||
- Artifact 模式: `synthetic`
|
||||
- 最近运行: `-`
|
||||
- 浏览器证据: `missing`
|
||||
- Run Bundle: `-`
|
||||
- 实证状态: `verified-real`
|
||||
- 实证方式: `real`
|
||||
- Artifact 模式: `local-fixture`
|
||||
- 最近运行: `nextjs-nextjs--CVE-2020-15242-20260318012830`
|
||||
- 浏览器证据: `present`
|
||||
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830`
|
||||
|
||||
## 事件层
|
||||
|
||||
|
||||
@@ -8,10 +8,10 @@ updated_date: "2025-09-10T21:12:24Z"
|
||||
severity: "low"
|
||||
exploit_status: "unknown"
|
||||
source_confidence: "official"
|
||||
verification_status: "triage-manual"
|
||||
verification_mode: "synthetic"
|
||||
artifact_mode: "synthetic"
|
||||
last_run_id: ""
|
||||
verification_status: "verified-real"
|
||||
verification_mode: "real"
|
||||
artifact_mode: "local-fixture"
|
||||
last_run_id: "nextjs-nextjs--CVE-2024-51479-20260318012913"
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc
|
||||
|
||||
## 本地实证状态
|
||||
|
||||
- 实证状态: `triage-manual`
|
||||
- 实证方式: `synthetic`
|
||||
- Artifact 模式: `synthetic`
|
||||
- 最近运行: `-`
|
||||
- 实证状态: `verified-real`
|
||||
- 实证方式: `real`
|
||||
- Artifact 模式: `local-fixture`
|
||||
- 最近运行: `nextjs-nextjs--CVE-2024-51479-20260318012913`
|
||||
- 浏览器证据: `missing`
|
||||
- Run Bundle: `-`
|
||||
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913`
|
||||
|
||||
## 事件层
|
||||
|
||||
|
||||
在新工单中引用
屏蔽一个用户