20682 matches found
CVE-2026-19975
cve-id Donar Ayuda a mantener este proyecto Si encuentras útil este proyecto, considera apoyar su mantenimiento continuo a través de PayPal o ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ El diez por ciento de cada donación se contribuye al Hospital...
CVE-2025-25296
CVE-2025-25296 概念验证（POC） 描述 本项目演示了针对 CVE-2025-25296 漏洞的概念验证（POC），该漏洞影响开源数据标注工具 Label Studio。漏洞位于 /projects/upload-example 端点，该端点未能对 GET 请求中用户提供的 HTML 内容进行清理。这允许攻击者在受害者的浏览器中执行任意 JavaScript，从而导致潜在的跨站脚本（XSS）攻击。 漏洞详情 受影响组件 ：Label Studio 的 /projects/upload-example 端点 影响 ：跨站脚本（XSS） 根本原因 ：GET 请求中用户提供的...
CVE-2026-67401
cve-id Donar Ayude a mantener este proyecto Si encuentra útil este proyecto, considere apoyar su mantenimiento continuo a través de PayPal o ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ El diez por ciento de cada donación se destina al Hospital Infantil...
EUVD-2026-44641
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header...
CVE-2026-107700
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700
The dot-access library (versions 0.0.3 through 1.0.0 ) contains a code injection vulnerability (CWE-94) within the get() function. The root cause is the insecure concatenation of a path argument into a new Function body in index.js. This allows remote attackers to supply crafted paths to reach co...
Get-NetNTLM
Get-NetNTLM Módulo de Powershell para obtener el hash NetNTLMv2 del usuario actual Ejemplo de uso: PS C: Get-NetNTLM-Hash Administrator::desktop:1122334455667788:4FFFB35....F18337AB10:0101000000000000BD526...4006F0072006D000000000000000000...
CVE-2025-41244-PoC
PoC CVE-2025-41244 VMware Aria Operations &1" VERSIONEND done Extracto de get-versions.sh líneas 119-124: getversion "/\S+/httpd-prefork|httpd|httpd2-prefork$|\s" -v getversion "/usr/bin|sbin/apache\S" -v getversion "/\S+/mysqld$|\s" -V getversion ".?/\Snginx$|\s" -v getversion...
HotelDruid-CVE-2021-42948
CVE-2021-42948 Se descubrió que HotelDruid Hotel Management Software v3.0.3 y versiones anteriores exponían tokens de sesión en múltiples enlaces mediante parámetros GET, lo que permite a los atacantes acceder a los ID de sesión de los usuarios. El token de sesión utilizado para acceder a las...
cve-2026-1731-scanner
CVE-2026-1731 — Escáner Pasivo de Vulnerabilidades BeyondTrust RS/PRA ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ CVE-2026-1731 ║ ║ Escáner Pasivo de Vulnerabilidades BeyondTrust RS/PRA ║ ║ ║ ╠═══════════════════════════════════════════════════════════════╣ ║ ESCÁNER...
CVE-2026-30498
CVE-2026-30498 – Vulnerabilidad CSRF AdminPanel 4.0 Resumen ID CVE: CVE-2026-30498 Reservado por MITRE Descubridor: Mehdi Ben Hamou Existe una vulnerabilidad de Cross-Site Request Forgery CSRF en el endpoint delete.php de AdminPanel 4.0. Esta vulnerabilidad permite a un atacante desencadenar...
CVE-2020-10257
/ \ \ / /|| \ / |/ | | | \ V /| | / / / / || | / /| \ / / | / | | / / / || /| /// by darkcast CVE-2020-10257: Vulnerabilidad de ejecución remota de código RCE no autenticada en el plugin TRX Addons de WordPress Plugin afectado: TRX Addons Tipo de vulnerabilidad: Ejecución remota de código RCE no...
CVE-2026-33340
CVE-2026-33340：lollms-webui 中的 SSRF 漏洞 概述 字段| 详情 ---|--- CVE ID| CVE-2026-33340 漏洞类型| 服务端请求伪造（Server-Side Request Forgery, SSRF） 受影响产品| ParisNeo/lollms-webui（LoLLMs WEBUI） 严重等级| 严重 — CVSS 9.1 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918：服务端请求伪造（SSRF） 受影响组件|...
CVE-2026-93017
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...
CVE-2026-88257
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beammcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric...
S2-046_S2-045_POC
S2-046POC 用法： ./s2046.sh url ./s2045.sh url 示例： 1. chmod +x ./s2046.sh 2. ./s2046.sh http://172.16.152.135/index.action 输出： ================HTTP GET Method================ uid=0root gid=0root groups=0root context=unconfinedu:unconfinedr:unconfinedjavat:s0-s0:c0.c1023 uid=0root gid=0root...
CVE-2020-14882
CVE-2020-14882 此脚本利用未经身份验证的GET请求在Oracle WebLogic Server上实现远程代码执行（RCE）。它利用了漏洞CVE-2020-14882。通过执行任意命令，攻击者可以未经授权地访问服务器。 漏洞利用详细信息 Exploit标题：Oracle WebLogic Server，通过GET请求实现未经身份验证的RCE Exploit作者：Danny Safaya CVE：CVE-2020-14882 厂商主页：Oracle WebLogic Server 软件链接：Oracle Middleware Downloads 更多信息：WebLogic R...