CVE-2020-25078

CVE-2020-25078 사용 설명 instructions attack url을 동일 디렉토리에 ip.txt로 넣으세요 공격 IP는 ip.txt와 같은 디렉토리에 위치합니다. 터미널 로그 root@localhost:/CVE-2020-25078ls CVE-2020-25078.py ip.txt root@localhost:/CVE-2020-25078cat ./ip.txt https://xxx.xxx.xxx.xxx:3128 http://xxx.xxx.xxx.xxx:80 https://xxx.xxx.xxx.xxx:8080...

CVE-2024-49328-exploit

CVE-2024-49328-exploit 🌟 설명: 이 스크립트는 WordPress용 WP REST API FNS 플러그인의 권한 상승 취약점을 악용합니다. 이 취약점은 1.0.0 이하의 모든 버전에 영향을 미치며, 인증되지 않은 공격자가 관리자 권한을 획득할 수 있습니다. ⚙️ 사용법 options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site -e NEWEMAIL, --Newemail NEWEMAIL New...

CVE-2019-9053-port-py3

Эксплойт CVE-2019-9053 - Python 3 Это порт на Python 3 эксплойта CVE-2019-9053, который нацелен на версии CMS Made Simple CMSMS до 2.2.10. Уязвимость позволяет выполнить SQL-инъекцию через интерфейс модуля News. Пример вывода Протестировано на TryHackMe Simple CTF Challenge. Описание Эксплойт...

CVE-2026-59788

A Stored XSS vulnerability exists in the email media type OAuth form because the application passes the Authorization endpoint value to window.open() without validating the URL scheme. This allows for the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type ...

CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

EUVD-2026-92400

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2023-0157

CVE ID : CVE-2023-0157 취약점 유형 : 디렉터리 트래버설 설명 : WordPress용 All-In-One Security AIOS 플러그인은 버전 5.1.4까지 디렉터리 트래버설에 취약합니다. 이로 인해 관리자 수준 권한을 가진 인증된 공격자가 서버의 임의 파일 내용을 읽을 수 있습니다. 재현 단계 : Just create a test.pdf file with JavaScript content necessarily in one line and display the file in the Host system...

CVE-2023-22515-Scan.

CVE-2023-22515-Scan Описание Это простой сканер для CVE-2023-22515 — критической уязвимости в Atlassian Confluence Data Center и Server, которая активно эксплуатируется злоумышленниками для «создания неавторизованных учётных записей администратора Confluence и доступа к экземплярам Confluence»...

CVE-2024-27198

CVE-2024-27198 Обход аутентификации для TeamCity Server версии 2023.11.3 и ниже. NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-27198 Блог Rapid7:...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105253

A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed...

CVE-2026-105062

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105254

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...

UBUNTU-CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2017-13872-Patch

CVE-2017-13872-Патч Загрузите это программное обеспечение и выполните его, после чего оно запросит новый пароль для пользователя root. Пароль может быть другим, но, я думаю, по умолчанию он равен паролю администратора. Обновление Вы можете исправить ошибку, обновив вашу операционную систему...

CVE-2024-57429

CVE-2024-57429 PHPJabbers Cinema Booking System v2.0의 pjActionUpdate 함수에 있는 사이트 간 요청 위조CSRF 취약점으로, 원격 공격자가 인증된 관리자를 속여 승인되지 않은 요청을 제출하게 함으로써 권한을 상승시킬 수 있습니다. 영향: 이 CSRF 취약점을 악용하면 다음과 같은 무단 작업이 발생할 수 있습니다. 관리자의 비밀번호를 변경하여 사실상 관리자를 잠그는 행위. 사용자 역할을 업데이트하여 공격자의 권한을 관리자로 상승시키는 행위. 익스플로잇 - 개념 증명POC 사이트...

CVE-2026-2991

KiviCare = 4.1.2 - 인증 우회 CVE-2026-2991 PoC 📜 설명 CVE-2026-2991은 KiviCare – Clinic & Patient Management System EHR WordPress 플러그인의 인증 우회 취약점으로, 4.1.2 를 포함한 모든 버전에 영향을 미칩니다. 이 플러그인은 소셜 로그인을 통해 사용자를 인증하는 공개 REST 엔드포인트 /wp-json/kivicare/v1/auth/patient/social-login을 노출합니다. patientSocialLogin 함수는 이메일 주...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...