74737 matches found
CVE-2025-60854
CVE-2025-60854 D-link AX1500 Vulnerability I recently conducted a vulnerability analysis on a D-Link router and would like to document my findings. Target model: D-Link AX1500 Version : 1.20.01 and below The CVE number for this issue is currently published. The vulnerable function is as follows:...
CVE-2023-33782
CVE-2023-33782 Description D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability in the iperf3 diagnostics functionality. Proof of concept...
cve-2026-23989-opencloud-lab
CVE-2026-23989 ā OpenCloud / ownCloud Infinite Scale public-link scope bypass A self-contained, one-command lab that reproduces CVE-2026-23989 and proves it fixed, using the official upstream Docker images. A public share link that is supposed to grant access to one folder can be abused to read...
CVE-2023-33538
Exploit en Python para la Vulnerabilidad de InyecciĆ³n de Comandos en TP-Link TL-WR940N/TL-WR841N Instrucciones de Uso 1. VerificaciĆ³n BĆ”sica de Vulnerabilidad : python tplinkexploit.py -t 192.168.1.1 -u admin -p admin 2. Ejecutar Comando Personalizado : python tplinkexploit.py -t 192.168.1.1 -u...
CVE-2026-18937
abraxaslabs.tech Ā· github.com/abraxas Ā· @abraxasnull Ā· [email protected] Ā· CVE-2026-18937 CVE-2026-18937 Broken Link Checker 2.4.11 - wordpress.org I am @abraxasnull. Loopback lab. The client is CVE-2026-18937-Abraxas-Labs.py. Query vars become globals. On plain permalinks,...
deadfinder
Find dead-links broken links Documentation ā¢ Installation ā¢ Github Action ā¢ Contributing ā¢ Changelog Dead link broken link means a link within a web page that cannot be connected. These links can have a negative impact to SEO and Security. This tool makes it easy to identify and modify. Looking f...
dlkploit600
DLKPloiT600.py Simple Python script for D-Link vulnerability scan and test CVE-2019-13101 https://nvd.nist.gov/vuln/detail/CVE-2019-13101 https://www.cvedetails.com/cve/CVE-2019-13101/ https://us.dlink.com/en/security-advisory https://www.dlink.com/en/security-bulletin Requirements: python3.x...
D-Link DNS-320 - Remote Code Execution
The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. id: CVE-2019-16057 info: name: D-Link DNS-320 - Remote Code Execution author: DhiyaneshDk severity: critical description: | The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerabl...
TP-LINK - Local File Inclusion
TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...
CVE-2017-6206
CVE-2017-6206 The DGS-1510 Websmart switch series firmware has been found to have security vulneratiblies. The vulnerabilities include unauthenticated command bypass and unauthenticated information disclosure. exploit.sh contains both PoC code and it will create a remote user at specified D-Link...
Moniker-Link-CVE-2024-21413
š”ļø Moniker Link CVE-2024-21413 Room: Moniker Link CVE-2024-21413 ā TryHackMe Status: ā Completed Date: 30 May 2025 šÆ Objective Understand and exploit CVE-2024-21413, a vulnerability in Microsoft Outlook that bypasses Protected View using Moniker Links to leak NTLM credentials. Learn how to perform...
PT-2026-109740
Name of the Vulnerable Software and Affected Versions phi versions 0.1.1 through 0.28.4 open-multi-agent affected versions not specified Description An improper link resolution issue allows malicious repositories to bypass the workspace only writes restriction by exploiting lexical-only path chec...
tryhackme-moniker-link
tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 ā TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...
cve-2026-19900-PoC
CVE-2026-19900 LB-LINK X-PRO Authentication Bypass and RCE via null user CVE-2026-19900 Hardcored Credential and Authentication Bypass RCE via null user. Bypass via Header: Cookie:user=null Usage Build and run the script with a target host: go build cve-2026-19900-PoC.go ./cve-2026-19900-PoC -t...
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Summary A collaborator removed from a project keeps a live, automatic feed of that project's contents, because nothing on any revocation path deletes the webhook they created while they had access. Vikunja already has a revocation-cleanup routine that deletes other derived rows for exactly this...
Vikunja: Link-share token can enumerate users through the v2 API
Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...
EUVD-2026-78652
Vikunja: Link-share token can enumerate users through the v2 API...
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
Summary A user who has only read permission on a project can call the single link-share read endpoint and receive the share's hash field ā the secret credential that the anonymous POST /shares/share/auth endpoint exchanges for a link-share JWT carrying the share's permission read / read-write /...