westone-CVE-2021-37580-scanner

westone-CVE-2021-37580-scanner Apache Shenyu est une solution de passerelle API extensible, haute performance et réactive, applicable à tous les scénarios de microservices. Une vulnérabilité de contournement d'authentification existe dans l'admin Apache Shenyu. L'utilisation inappropriée de JWT...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, remote code execution may be triggered in downstream applications. Source...

CVE-2026-13447

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-13447 CVE-2026-13447 MStore API 4.18.4 - inspireui I am @abraxasnull. Loopback lab. The client is CVE-2026-13447-Abraxas-Labs.py. The kid is not a signature. FirebasePhoneAuthHelper::verifyidtoken checks alg...

CVE-2025-44823

Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo CVE ID: CVE-2025-44823 Date: 2025-04-02 Authors: Alex Tisdale, Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details How It Work...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard earlier versions 2.10.1 has security vulnerability on unauthorized access. the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2026-104286-POC

Эксплойт обхода пути FortiMail CVE-2026-104286 Обзор Продвинутый эксплойт удалённой записи произвольных файлов без аутентификации для CVE-2026-104286 в FortiMail. Специально сформированные HTTP/HTTPS-запросы обходят санитизацию путей в веб-клиенте, что позволяет создавать произвольные файлы в...

CVE-2026-104051-pictshare-info-disclosure

CVE-2026-104051 — Раскрытие конфиденциальной информации через API info в PictShare Авторизованное исследование безопасности. PoC только для защитного и образовательного использования. Конечная точка /api/info/ в PictShare возвращает полный необработанный объект метаданных для любого загруженного...

CVE-2026-102973

CVE-2026-102973: обход хука авторизации API отправки email Автор отчёта: Marco Paciaroni BomboBombone. Путь API action=emailuser в MediaWiki не вызывал хук EmailUserAuthorizeSend. Когда расширение или политика сайта использовали этот хук для запрета отправителя, веб-форма применяла запрет, а путь...

CVE-2026-100903

CVE-2026-100903 GEOritm Отсутствие аутентификации Описание : Уязвимость в методе POST /restapi/objects/obj-groups REST API программного обеспечения GEO.RITM связана с отсутствием аутентификации перед выполнением функции. Влияние : Эксплуатация данной уязвимости может позволить злоумышленнику,...

vt-go

vt-go This is the official Go client library for VirusTotal. With this library you can interact with the VirusTotal REST API v3 without having to send plain HTTP requests with the standard "http" package. Usage example package main import "flag" "fmt" "log" "os" vt "github.com/VirusTotal/vt-go" v...

vt-py

vt-py This is the official Python client library for VirusTotal. With this library you can interact with the VirusTotal REST API v3 and automate your workflow quickly and efficiently. Things you can do with vt-py Scan files and URLs Get information about files, URLs, domains, etc Perform VirusTot...

MLflow-Vuln

Vuln replication-mlflow ver 2.1.1-prep by Saima.pdf MLflow-Vulnerability MLflow LFI/RFI Vulnerability -CVE-2023-1177 - Reproduced One of the most popular tools in a ML system is MLflow that is used for managing end-to-end machine learning lifecycle. I tested the security of MLflow and reproduced ...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...

CVE-2020-16846-Saltstack-Salt-API

CVE-2020-16846-Saltstack-Salt-API Vulnerability Explained: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. The details about this vulnerability can be found here:...