Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

qdPM 9.1 - Cross-site Scripting

qdPM V9.1 is vulnerable to Cross Site Scripting XSS via qdPM\install\modules\databaseconfig.php. id: CVE-2020-19515 info: name: qdPM 9.1 - Cross-site Scripting author: theamanrawat severity: medium description: | qdPM V9.1 is vulnerable to Cross Site Scripting XSS via...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

Label Studio < 1.16.0 - Cross-Site Scripting

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Ricoh Web Image Monitor - Reflected XSS

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. id: CVE-2025-41393 info: name: Rico...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

ATutor < 2.2.1 - Cross Site Scripting

ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. id: CVE-2023-27008 info: name: ATutor 2.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | ATutor 2.2.1 was discovered with a vulnerability, a...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

OPNsense - Cross-Site Scripting

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-39002 info: name: OPNsense - Cross-Site Scripting author: Herry severity: medium description...

CVE-2021-21424

CVE-2021-21424 目录遍历与文件暴露 • CVE-2021-21424 • 描述：如果未在生产环境中禁用 WebProfiler，则会暴露服务器内部路径。 • 受影响版本：Symfony 2.8 到 5.x。 • 典型绕过方式：直接访问 /appdev.php/profiler/。 CVE-2021-21424 摘要 • CVE：2021-21424 • 组件：Web Profiler / Dev Toolbar • 影响：敏感信息泄露（环境、路径、参数） • 条件：/appdev.php、/profiler 或 /wdt 在生产环境中可访问。 •...

CVE-2025-29927-Proof-of-Concept

逐步教程 步骤 1（5 分钟） 提示 目标暴露了哪些网络服务？ — — — 解决方案 kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p 步骤 2（5 分钟） 提示 1 登录页面只显示了一个登录页面，但网络服务器通常还会暴露其他路径。 提示 2 尝试使用目录暴力破解工具，例如 Gobuster 或 DirBuster。 — — — 解决方案 kali@kali:$ gobuster dir -u http://:/ -w /usr/share/wordlists/dirb/common.txt...

WebShells

WebShells WebShell 学习...

ai-agent-gateway

@tuskira/gateway-web Tuskira AI Agent Gateway 的管理控制台。React 19 + Vite + TypeScript（严格模式）+ Tailwind CSS 4 + shadcn/ui。 开发 需要 Node 26+ 和 npm 11+（不支持 pnpm）。 npm install npm run dev 开发服务器将 /api 代理到 http://localhost:8081（参见 vite.config.ts），因此 请在 :8081 上运行网关，与 UI 并行。使用网关签发的 API 密钥（gk…）在 /login 登录。...

tulpar

Tulparは、Webペネトレーションテストを自動化するために作成された、オープンソースのWeb脆弱性スキャナーです。Tulparには以下の機能があります。 -Sql Injection GET Method -XSS GET Method -Crawl -E-mail Disclosure -Credit Card Disclosure -Whois -Command Injection GET Method -Directory Traversal GET Method -File Include GET Method -Server Information -Technology...

SmartScanner-Source

SmartScanner 一个使用 C++17 和 Qt 6 构建的 Web 漏洞扫描器，具有图形界面和命令行界面。 本仓库包含 SmartScanner 3.0.0 的重建版本，仅供教育目的使用。它结合了 Web 爬取引擎、漏洞检测模块和 JSON 报告功能。 功能特性 Web 爬取 ：链接和表单分析、robots.txt 和站点地图处理、可配置的爬取深度和范围。 注入测试 ：SQL、XSS、XXE、操作系统命令注入、文件包含和 SSRF。 配置检查 ：HTTP 头、HTTPS/TLS、重定向、暴露的文件和目录列表。 技术检测 以及针对 WordPress、Joomla 和 Drupa...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com 重定向到任意网站（在本例中为 https://example.com）。 patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

onioff

██████╗ ███╗ ██╗██╗ ██████╗ ███████╗███████╗ ██╔═══██╗████╗ ██║██║██╔═══██╗██╔════╝██╔════╝ ██║ ██║██╔██╗ ██║██║██║ ██║█████╗ █████╗ ██║ ██║██║╚██╗██║██║██║ ██║██╔══╝ ██╔══╝ ╚██████╔╝██║ ╚████║██║╚██████╔╝██║ ██║ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═════╝ ╚═╝ ╚═╝ v2.0 A simple tool - written in pure python - f...