CVE-2024-42327_Zabbix_SQLI

CVE-2024-42327 - Vulnerabilità di SQL Injection in Zabbix SQLI Non cieca e non basata sul tempo POC per CVE-2024-42327, una SQL Injection autenticata in Zabbix tramite il metodo API user.get. Questo POC non è basato sul tempo come alcuni altri POC che ho visto in giro. Descrizione della CVE La...

CVE-2026-38698-and-CVE-2026-38699

Pesquisa sobre Wyze Cam Pan v3 Slides Referência CVE-2026-38698 Nome do Ataque Estouro de heap na função tutkpacketalloc em tutkavserver Detalhes Adicionais Produto Afetado TUTK SDK v.3.1.10.0 até v.4.3.8.1 Componente Afetado função tutkpacketAlloc Vetor de Ataque Um atacante autenticado deve...

CVE-2024-51031

CVE-2024-51031 Descrizione Una vulnerabilità di Cross-site Scripting XSS in manageaccount.php in Sourcecodester Cab Management System 1.0 consente a utenti remoti autenticati di iniettare script web arbitrari tramite i campi "First Name", "Middle Name" e "Last Name". Tipo di vulnerabilità Cross...

CVE-2024-48427

CVE-2024-48427 Descrizione Una vulnerabilità di SQL injection in Sourcecodesters Packers and Movers Management System v1.0 consente a utenti remoti autenticati di eseguire comandi SQL arbitrari tramite il parametro id in /mpms/admin/?page=services/manageservice&id Tipo di vulnerabilità SQL...

CVE-2024-46986

CVE-2024-46986 Exploração do Camaleon CMS - Upload Arbitrário de Arquivos Este repositório contém um script Python que automatiza a exploração de uma vulnerabilidade de upload de arquivos no Camaleon CMS. A vulnerabilidade permite que um atacante envie arquivos arbitrários como scripts Ruby para ...

CVE-2024-46377

CVE-2024-46377 PoC für Schwachstelle beim beliebigen Datei-Upload in Best House Rental Management System 1.0 Übersicht Dieses Python-Skript demonstriert, wie die Schwachstelle beim beliebigen Datei-Upload in Best House Rental Management System 1.0 ausgenutzt werden kann. Die Schwachstelle...

CVE-2021-29447

CVE-2021-29447 POC zum Ausnutzen von WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. Mehr über diese CVE hier Beispiel Beispielverwendung gegen die HackTheBox-Maschine MetaTwo, die eine WordPress-Website mit einer für XXE-Injection anfälligen Medienbibliothek hostet. root@kitploit: python...

CVE-2020-24028

CVE-2020-24028 Beschreibung ForLogic Qualiex v1 und v3 ermöglicht jedem authentifizierten Kunden eine Privilegieneskalation durch Benutzererstellung, Passwortänderungen oder Aktualisierungen von Benutzerberechtigungen. Wichtige Daten Ankündigung an Anbieter: 2020-07-12 Datum der öffentlichen...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78616

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-78618

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...

CVE-2026-78195

A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...

CVE-2026-78500

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78613

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78612

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78008

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service DoS condition or potentially execute arbitrary code by sending specially crafted network traffic...

CVE-2026-78103

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

DEBIAN-CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post Version 1.1.9 - SQL Injection I. Überblick 1. Was ist WordPress? WordPress ist ein Open-Source-CMS Content Management System, ein System zur Verwaltung von Inhalten. Anstatt HTML-Code zu verwenden, wird WP in der Programmiersprache PHP geschrieben...