Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter. id: CVE-2008-1547 info: name:...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass

Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

CVE-2021-21424

CVE-2021-21424 Directory Traversal y exposición de archivos • CVE-2021-21424 • Descripción: El WebProfiler expone rutas internas del servidor si no está deshabilitado en producción. • Versiones afectadas: Symfony 2.8 a 5.x. • Bypass típico: acceso directo a /appdev.php/profiler/. Resumen del...

CVE-2025-29927-Proof-of-Concept

逐步教程 步骤 1（5 分钟） 提示 目标暴露了哪些网络服务？ — — — 解决方案 kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p 步骤 2（5 分钟） 提示 1 登录页面只显示了一个登录页面，但网络服务器通常还会暴露其他路径。 提示 2 尝试使用目录暴力破解工具，例如 Gobuster 或 DirBuster。 — — — 解决方案 kali@kali:$ gobuster dir -u http://:/ -w /usr/share/wordlists/dirb/common.txt...

WebShells

WebShells WebShell estudiando...

ai-agent-gateway

@tuskira/gateway-web Admin console for the Tuskira AI Agent Gateway. React 19 + Vite + TypeScript strict + Tailwind CSS 4 + shadcn/ui. Develop Requires Node 26+ and npm 11+ no pnpm. npm install npm run dev The dev server proxies /api to http://localhost:8081 see vite.config.ts, so run the gateway...

SmartScanner-Source

SmartScanner Un escáner de vulnerabilidades web construido con C++17 y Qt 6, que incluye interfaces gráfica y de línea de comandos. Este repositorio contiene una reconstrucción de SmartScanner 3.0.0 con fines educativos. Combina un motor de rastreo web, módulos de detección de vulnerabilidades y...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirige a un sitio web arbitrario en este caso, https://example.com. patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2026-6356

Augmentt: Escalada de privilegios mediante manipulación de parámetros Créditos Este CVE fue un esfuerzo colaborativo entre: HelloWorld Autor – GitHub: https://github.com/Penquinsecq Raznov – GitHub: https://github.com/basraznov Descripción Una vulnerabilidad en la aplicación web permite a los...

SECMON

SECMON - 信息安全监控工具 -red 描述 SECMON 是一个基于 Web 的工具 ，用于自动化信息安全监控 和漏洞管理 ，并配有 Web 界面。 演示版请点击此处查看。Discord 频道请点击此处加入。 功能 当新 CVE 发布 且涉及您的产品列表时，发送邮件告警 当“网络安全”新闻发布 时发送邮件告警 ：新威胁、近期攻击、事件等 可视化您 IT 基础设施中存在的高安全风险产品 按日期范围下载 CVE Excel 报告 显示热门网络安全主题 （轻量级网络态势 ） 日志易于集成到 SIEM 中 （已在 Splunk 和 Graylog 上验证） 查看最新 CVE...

Source

LibreWolf Source Repository This repository contains all the patches and theming that make up LibreWolf, as well as scripts and a Makefile to build LibreWolf. There also is the Settings repository, which contains the LibreWolf preferences. LibreWolf overview graph LR FFSRCFirefox Source...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Descripción general TREX MES es una plataforma comercial de Sistema de Ejecución de Manufactura MES / Industria 4.0 utilizada para recopilar y gestionar datos desde la planta de producción. La API web de la aplicación ejecuta directamente el...

PT-2026-108911

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

PT-2026-108882

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0...

PT-2026-108827

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

PT-2026-108845

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2...

PT-2026-108831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10...