WBCE-v1.6.3-Authenticated-RCE

WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; モジュールがこのチェックを通過して "有効なアドオン" と見なされると、install.php スクリプトがサーバー上で自動的に実行されます。このエクスプロイトは、PHP ペイロードとして単純に php リバースシェル を使用します。 YouTube デモ: https://youtu.be/Dhg5gRe9Dzs?si=LHC29PBRRRPNNy73 Description: This is an Authenticated RCE exploit for WBCE CMS...

Exploits

Exploits Ron Jost によって開発されたエクスプロイトのコレクション エクスプロイト開発のリクエストについては、こちらまでご連絡ください: [email protected] 目次: Wordpress プラグイン XCloner 4.2.12 - リモートコード実行 認証済み: CVE-2020-35948 Wordpress プラグイン Modern Events Calendar Lite 5.16.5 - RCE 認証済み: CVE-2021-24145 Wordpress プラグイン Modern Events Calendar Lite 5.16.5 ...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE の double-free → リモートコード実行 Rocky Linux 8.10、aarch64、Redis 8.6.2、jemalloc 5.3.0 で検証済み。 リファレンス: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive TLDR; 安定したエクスプロイトで、さまざまな OS ディストリビューションとアーキテクチャで動作します。 エグゼクティブサマリー これは何か？ Redis におけるメモリ破損の脆弱性で、認証済みの攻撃者が Redis...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells의 무단 역할 할당 CVE-2023-32749에 대한 익스플로잇은 Pydio Cells 4.1.2 및 이전 버전에 영향을 미칩니다. 낮은 권한의 인증된 사용자가 모든 역할이 할당된 새로운 외부 사용자를 생성하여 인스턴스 전체의 모든 셀 및 비개인 작업 공간에 접근할 수 있습니다. 영향을 받는 버전 Pydio Cells 4.1.2 및 이전 버전 4.2.0, 4.1.3, 3.0.12에서 수정됨 요구 사항 pip install requests 사용법 인증된 세션에서 Bearer 토큰...

CVE-2026-34197

🚨 CVE-2026-34197 — Apache ActiveMQ における重大な Jolokia RCE Jolokia MBeans 経由の認証済み RCE → リモート Spring XML → JVM コード実行 📖 概要 CVE-2026-34197 は、Apache ActiveMQ Classic に影響を与える 高深刻度の認証済みリモートコード実行脆弱性 です。 この問題は、以下のように公開されている Jolokia JMX-HTTP ブリッジ に存在します。 /api/jolokia/ 認証済み攻撃者は、以下のような危険な MBean メソッドを悪用できます。...

cve-2022-23636-poc

CVE-2022-23626 - m1k1o的博客 认证远程代码执行 通过 m1k1o的博客 v1.3 及以下版本中的文件上传漏洞实现认证远程代码执行。 描述 ajax.php?action=uploadimage 端点未能正确验证上传的文件类型，允许已认证用户上传伪装成图片的 PHP 网页后门。攻击者随后可通过直接请求上传的文件来触发执行。 参考 EDB-50943 CVE-2022-23626 m1k1o/blog GitHub 受影响版本 m1k1o的博客 v1.3 及以下 要求 Python 3 requests 库 pip install requests 用法 执行命令...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

Cuppa CMS v1.0 - Remote Code Execution

CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php. id: CVE-2022-37190 info: name: Cuppa CMS v1.0 - Remote Code Execution author: theamanrawat severity: high description: | CuppaCMS 1.0 is vulnerable ...

Simple File List < 4.4.12 - Cross Site Scripting

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting id: CVE-2022-3062 info: name: Simple File List 4.4.12 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does not escape parameters before...

WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection

WordPress Visitor Statistics Real Time Traffic plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks. id: CVE-2021-247...

Download Monitor < 4.4.5 - SQL Injection

The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...

AirFlow < 2.4.0 - Remote Code Execution

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. id: CVE-2022-40127 info: name: AirFlow 2.4.0 -...

OpenEMR <5.0.2 - Local File Inclusion

OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajaxdownload.php. An attacker can download any file that is readable by the web server user from server storage. If the requested file is writable for the web server user and the directory...

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin versions 1.49 and earlier within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on th...

WBCE CMS v1.5.4 - Remote Code Execution

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. id: CVE-2022-46020 info: name: WBCE CMS v1.5.4 - Remote Code Execution author: theamanrawat severity: critical description: | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. impact: | Successful...

pfSense - Arbitrary File Write

diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...

WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvividuploadimportfiles' function in all versions up to, and including, 0.9.116. id: CVE-2025-5961 info: name: WordPress WPvivid...

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

Winter CMS Local File Inclusion - (LFI)

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local...