129888 matches found
CVE-2023-46404
CVE-2023-46404 PCRS è una webapp per esercizi di programmazione online sviluppata all'Università di Toronto. Vedi repository Bitbucket: https://bitbucket.org/utmandrew/pcrs/src/3.11/ Riepilogo La pagina “Questions” di PCRS con invio di codice e la pagina “Code editor” sono vulnerabili...
CVE-2018-9276
CVE-2018-9276 PRTG 18.2.39 Iniezione di comandi autenticata Reverse Shell https://nvd.nist.gov/vuln/detail/CVE-2018-9276 Versione migliorata di un exploit scritto da https://github.com/M4LV0. Ho usato i dati POST dal loro script ma l'ho reso più affidabile dato che non avevo molto successo con...
CVE-2024-35584
CVE-2024-35584 OpenSIS Authentifizierte SQL-Injection Beschreibung Es besteht eine SQL-Injection-Schwachstelle in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. Dieser Befund betrifft OpenSIS Community Edition 9.1 bis 8.0 und möglicherweise niedrigere Versionen...
CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...
CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...
EUVD-2026-67407
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...
CVE-2025-2304-POC
CVE-2025-2304 Escalation dei privilegi in Camaleon CMS Esempio root@kitploit: python3 exploit.py http://target.com attacker attacker Dopo lo sfruttamento riuscito, esci e accedi di nuovo per ottenere i privilegi di amministratore. Riferimenti https://nvd.nist.gov/vuln/detail/CVE-2025-2304...
fortios-auth-bypass-check-CVE-2024-55591
CVE-2024-55591 Fortinet FortiOS प्रमाणीकरण बाईपास संवेदनशील व्यवहार जांच कार्य में जांच root@kitploit: python CVE-2024-55591-check.py --target 192.168.1.10 --port 443 / | | |\ \ \ / / \ \ / | | \| | / \ / / \ \ \ / / | | \ \| Y | | \ / | | \ // || \\ ||| | \ / \// || \ \ \...
CVE-2024-42327_Zabbix_SQLI
CVE-2024-42327 - Vulnerabilità di SQL Injection in Zabbix SQLI Non cieca e non basata sul tempo POC per CVE-2024-42327, una SQL Injection autenticata in Zabbix tramite il metodo API user.get. Questo POC non è basato sul tempo come alcuni altri POC che ho visto in giro. Descrizione della CVE La...
CVE-2026-38698-and-CVE-2026-38699
Pesquisa sobre Wyze Cam Pan v3 Slides Referência CVE-2026-38698 Nome do Ataque Estouro de heap na função tutkpacketalloc em tutkavserver Detalhes Adicionais Produto Afetado TUTK SDK v.3.1.10.0 até v.4.3.8.1 Componente Afetado função tutkpacketAlloc Vetor de Ataque Um atacante autenticado deve...
CVE-2024-51031
CVE-2024-51031 Descrizione Una vulnerabilità di Cross-site Scripting XSS in manageaccount.php in Sourcecodester Cab Management System 1.0 consente a utenti remoti autenticati di iniettare script web arbitrari tramite i campi "First Name", "Middle Name" e "Last Name". Tipo di vulnerabilità Cross...
CVE-2024-48427
CVE-2024-48427 Descrizione Una vulnerabilità di SQL injection in Sourcecodesters Packers and Movers Management System v1.0 consente a utenti remoti autenticati di eseguire comandi SQL arbitrari tramite il parametro id in /mpms/admin/?page=services/manageservice&id Tipo di vulnerabilità SQL...
CVE-2024-46986
CVE-2024-46986 Exploração do Camaleon CMS - Upload Arbitrário de Arquivos Este repositório contém um script Python que automatiza a exploração de uma vulnerabilidade de upload de arquivos no Camaleon CMS. A vulnerabilidade permite que um atacante envie arquivos arbitrários como scripts Ruby para ...
CVE-2024-46377
CVE-2024-46377 PoC für Schwachstelle beim beliebigen Datei-Upload in Best House Rental Management System 1.0 Übersicht Dieses Python-Skript demonstriert, wie die Schwachstelle beim beliebigen Datei-Upload in Best House Rental Management System 1.0 ausgenutzt werden kann. Die Schwachstelle...
CVE-2021-29447
CVE-2021-29447 POC zum Ausnutzen von WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. Mehr über diese CVE hier Beispiel Beispielverwendung gegen die HackTheBox-Maschine MetaTwo, die eine WordPress-Website mit einer für XXE-Injection anfälligen Medienbibliothek hostet. root@kitploit: python...
CVE-2020-24028
CVE-2020-24028 Beschreibung ForLogic Qualiex v1 und v3 ermöglicht jedem authentifizierten Kunden eine Privilegieneskalation durch Benutzererstellung, Passwortänderungen oder Aktualisierungen von Benutzerberechtigungen. Wichtige Daten Ankündigung an Anbieter: 2020-07-12 Datum der öffentlichen...
CVE-2026-78615
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-78614
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78616
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...