corporate

Russian

_ym_isad

flocktory-uuid

locationId

advUserId

_ym_d

_ym_uid

userTags

bannerSession

bannerSessionCount

notices

_ym_visorc

You're looking at domain 'ucheba.ru' on the Russian country-code top-level domain (.ru). The registrable portion 'ucheba' spans 6 characters split between three vowels and 3 consonants. Splitting it apart reveals 3 words: u, cheb, a. Median word length comes out to 1 character. No strong language cues emerged from the frequency lists.

name

phone

class

isParent

Записаться на консультацию

html/c4/14/c414a7f3-e8ce-4044-83be-652b73c6b36b.html.gz

object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;

inline; filename="img__select-vuz-by-ege_desktop-fe2a80e7a4c25b1a5dec26162cefb48c.webp"

script-src 'none'; frame-src 'none'; sandbox;

iframe_flock_data_provider

8289920dc033a24c8b59e7ad88d28ccb6af0476ae1d8cbc8b4f95c49e89ecbf7

ef76672c1d8c6cb50abedeac638665ece75bb1940fce5dc4366ba1db5e729f63

73b9dd04a9b9a64280dee6edd92afb6fa21a84899dec973ee3f808c890f79b19

9b90a43a13f6631a4b2a78e1dc46b83d589b7d8ce01a63d920390e8a88224729

8a57b91a46d8e8e416224a92e1dbe787633f8df8c482ad369dfabc7e3d788976

326097ca969b9eae742fe3c4ea6bb6f693c7a507e911b91e0c4962313fb419a9

7c1293cc2c7a5f580354cd22685f9315765d2b706cecc6af65b21a0dcccbdcf0

c50b81825ff486e26df30002309b5a4a768ecfaf0d23cc01a71c2b4d74bcfe7f

455a63f841afaaa1a5a5798719f0cb4c9b727ee7e054ba8ba7bfe1a43a6f5cff

d537b2aaadc595046cb8242d00f3c7bdc1003813fdda1033021165cac967c969

bd8ea78180a230ec9e62acb6a5c2af2ed4d8326cd489ff3bd1eec0d7bfb293a4

8ce6521ed75ced78dd599602a97e63f4ea62fae8815bdf2f946aa8fa1a809baf

a2b7b403d2473a68a1e9cff0c79f0a34669380e5c274b72b3c5bbb5bdef54037

20256476591777de9eac198dea70632adc553b9ddbb356d3e020a42bb72f9352

6b720269de3e0b320178743dca020b5d6a73654e189d204be03ace5a7a02b63b

30a0e01d67d42b7934efd262ce4e80332f1683a68f33af5fb8e724869f1ae6e3

e7203af9116f93b3be98a4b2671c59d8864c68c5e006eb9d93f159fd809046ac

9752581b934619247cd7131a942dd3c127b8a080ff51f103488f26c40b586d2c

fbf550c87803df0ea46a60eaae73ea78074ea6d0065f49d1dbd1dc2759c0642c

cfc4328f47213c58a727358864a629e0937d55a4dc69c0257028506f290dfede

0234f7f3a26a3ff71648cd97f501274958d9d52908046b5e0a86a38f3959efcf

9f29be2de75345a8817bc3793f9ebd1d6e99bb7d2c42f735d900f386472fb44d

2eb38939595613e9d65122889b5d7459ac10ecfc6451d655370b7ee626d0188b

874cc13973fb71eafed1c814597f06a26d202f6851a3e06f00b1f2d697365bcf

c20efa9cecc0dd0f86c95d24bbf57c7fd00ecaa8bfdf8b5a6e82daee81f28280

d0f7a7561c6226a6a3866ffae832cbadabad4e704cffc82c0e0c6e79a5b07ffb

16d3806ad6d00f2d2f4ba6c5a5065fe951ce552f69e27726c3a1016529b88bf5

52a79ff3c893254b05cfe605421604360bab5c5e1e7e77cfb0b40c894a5f3f61

235a5ad85cfdf0146b8b78c1e7d7f5fb764abe40a5a2778e6dc968c3f9005684

9a0d3a053bfe4d7bd964951d929dbe109f13f4b67078989808198b16925168cb

d40821783ec22d1e8905bea7f3d79733bb189a75bc374f0d3228295e9c012955

bbd8d00afc0201624b21935f6c7430feef7c2d7236442dbef46b127a9153cda7

065290d087cbaf5fe3766e33fcd3df3e0868ea7d57bd0f6ded251bc9ea0fb395

27b98638945af16319dda11d8cefbacb8d923d205ec6f6009f86f1b788caf189

268d0c14524b3f1d6dc49ac02d0b805d8c6fa5ecf2d27cf9a463042f53baf4e5

9b51207e524461ba84c93401cfa69df52ff19989da6dd9bf8dd10ac2f9010d8c

de1a5713e41c85998ec2f1532412331e8f652ce902eff966a8acc1ad548319f5

d8f39ae47239bbc607f0c75eb3b298bd1b28a38772f767d9ddf07f15729330d2

da00c8f4ec8bbf9648a5dbae49b8e4a016a3f41e0087b07c90dc58627c635a27

586742805df061835aad56026a225c208fd04733e1c28305f4540d12cd7bed1a

224b62f87f58ada54ceb0e4e01d67c08921712c17a6729e3452a139ddab6f22f

d14257dd156133f7a4e6ca2708032fe83488aa9d2e7762a38ce37dd0e848126d

71110c2d630f57e267023badb67254aa1f3dbf43c4e551269d73c0aa76f08c90

842a8037f58921adeb7f75ab324aeedaea31b279c889da862008d7fa29141eeb

b435bd46318c62d9eae9361c5b480c56cb2c0f3100e5e8093c02bb244c563eeb

5ed9d39e0f354ec003a70e5ac31531ea82a3a03733f007a2ec2c0ecd22289ae2

548d3c5c72dd0b38c3e110042f887e8f57f4af5cdf8bb49594c329c4a7e2ddbf

a938fc57d79d39a8cb588111a93d0925fa10cd3f6555f6f0c3788901611f24c5

3b3972769508ee356ea12fe9488a93f08078c43f1013bc4511d2caee0d760ba6

08832a105e6b204a3c4969deaea67f4e93e52ddbd7a689709bd7dc10b3168322

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Allows a Denial of Service (DoS) with Server Actions

Next.js Race Condition to Cache Poisoning

Authorization Bypass in Next.js Middleware

Information exposure in Next.js dev server due to lack of origin verification

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

e903cec1d59e0157bcc7e4ac883ae6f866babb60e4aa01b9485aa096b9722200

bb28eb864cc1e6dceeef0c8fe05cc3ef95495bb55fa8aacd4d14ac12e4392ba1

e8ef0326423f4b1f4d06a0f2f1b3d4d6daa0584c3a9d9b19576dbbf97d53b3b9

Сопровождение при поступлении

Согласия на обработку персональных данных

Пользовательского соглашения.

гуманитарные и социальные науки
83
специальности
848
вузов

управление и экономика
38
специальностей
835
вузов

информационные технологии
35
специальностей
819
вузов

медиа, дизайн и архитектура
25
специальностей
603
вуза

техника и технологии
140
специальностей
559
вузов

точные и естественные науки
44
специальности
378
вузов

безопасность и военное дело
23
специальности
375
вузов

искусство и творчество
50
специальностей
232
вуза

медицина и здравоохранение
12
специальностей
188
вузов

Подберем вузы по баллам ЕГЭ
Укажите ваши предметы и баллы ЕГЭ, и мы подберём подходящие для поступле

Деловое администрирование 1 вуз

Целевой набор в МГПУ
Стань учителем мирового уровня в МГПУ! Целевой набор открыт - ссылка на заявку 

Портфолио абитуриента — 2026
Количество баллов за индивидуальные достижения

Расписание ОГЭ — 2026
Опубликован проект совместного приказа Минпросвещения и Рособрнадзора о сроках

Расписание ЕГЭ — 2026
Даты экзаменов в 2026 году

Все способы поступить в вуз
Как повысить свои шансы на зачисление?

На что обращать внимание при выборе колледжа?
Важные критерии: чек-лист для абитуриента

С чего начать выбор профессии?
Шесть важных советов для правильного старта

Поступать в вуз или идти в колледж?
Плюсы и минусы обоих вариантов

Как оценить и увеличить шансы на поступление?
Лайфхаки для абитуриентов

Как поступить в вуз вне конкурса?
Льготы для победителей олимпиад

Экскурсия в Институт экономики и управления НИТУ МИСИС

Колледж «Московская академия предпринимательства»

Персональный День открытых дверей в колледже МОСАП

Омский филиал IT колледжа TOП

День открытых дверей в Омском филиале IT колледжа TOП

Московская академия предпринимательства

Персональный День открытых дверей в ВУЗе МОСАП

День открытых дверей Механико-машиностроительного факультета СПГУ

Показать все мероприятия

31 МАЯ | 16:00
День открытых дверей Медиа Института «Останкино»
Спикеры: Мария Ситтель, Елена Летуча

Учебным заведениям
Всё, что нужно
для привлечения абитуриентов
Узнать больше

Бесплатный тренажер по подготовке к ЕГЭ

Тренажер ЕГЭ по русскому языку

Тренажер ЕГЭ по математике

Тренажер ЕГЭ по обществознанию

Тренажер ЕГЭ по биологии

Тренажер ЕГЭ по информатике

Тренажер ЕГЭ по физике

Бесплатный тренажер по подготовке к ОГЭ

Тренажер ОГЭ по русскому языку

Тренажер ОГЭ по математике

Тренажер ОГЭ по обществознанию

Тренажер ОГЭ по биологии

Тренажер ОГЭ по информатике

Тренажер ОГЭ по физике

viewport

theme-color

yandex-verification

verify-admitad

robots

googlebot

Кем стать? Какую профессию, специальность и образование выбрать? Куда пойти учиться? В вуз или колледж? Как подготовиться, чтобы успешно поступить на бюджет? Учёба.ру поможет на всех шагах от профориентации до подготовки к ЕГЭ и успешного поступления.

description

Поможем определиться с профессией и специальностью, выбрать вуз или колледж и подготовиться к успешному поступлению — Учёба.ру

https://www.ucheba.ru/pix/upload/default/img__og-image_index-page_new.png

next-head-count

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

ucheba.ru

Yandex Abuse handler

Yandex LLC Network Operations

YANDEX LLC

YANDEX-MNT

YANDEX-87-250-250-0


              window.dataLayer = window.dataLayer || [];
              function gtag(){dataLayer.push(arguments);}
            

Requests	IP Address	Location	AS Autonomous System
69	158.160.126.5	Moscow, Moscow, Russia	AS200350Yandex.Cloud LLC
69	212.74.251.101	Russia	AS50340JSC Selectel
138	2	-	-

Security Scan Report: ucheba.ru

Summary

AI Security Verdict

Moderate Risk

Risk Factors

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History