Log4j-Updater

Log4j 업데이터 Log4j라는 유명한 Java 프레임워크를 업데이트해야 하는 불가피한 필요성으로 인해 많은 기업들이 여러 대의 컴퓨터에서 동시에 Log4j를 업데이트해야 하며, 이는 시간과 비용이 소요됩니다. 바로 여기서 Log4j 업데이터 가 등장합니다. log4jupdater.sh는 시스템에서 사용할 패키지 관리자를 자동으로 감지하고, log4j 저장소가 있는 경우 업데이트하여 최신 버전을 설치함으로써 여러 대의 머신에서 업데이트 프로세스를 자동화 하는 것을 목표로 하는 간단한 bash 스크립트입니다. 호환성 스크립트와...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Обновление произвольных опций для подписчиков и выше Описание Плагин Content Mask для WordPress версий до 1.8.4.1 не имеет проверок авторизации и CSRF в различных AJAX-действиях, а также не проверяет, что обновляемая опция принадлежит плагину. В результате любой...

cve-2021-21425

Эксплойт для: GravCMS 1.10.7 - Произвольная запись/обновление YAML без аутентификации Использование: root@kitploit: python3 exploit.py --url http://192.168.204.12/grav-admin Ожидаемое поведение Не используйте этот эксплойт на системах, на которые у вас нет разрешения! Удачного взлома...

CVE-2015-7547

CVE-2015-7547 glibc 취약점 테스트 스크립트 이 스크립트는 glibc 취약점 CVE-2015-7547을 테스트하기 위한 셸 스크립트입니다. Red Hat Enterprise Linux / RHEL / CentOS 5/6/7와 같은 rpm 기반 시스템용으로 작성되었습니다. 다른 배포판에 대한 탐지는 추후 추가될 수 있습니다. 해결 방법 1. bin/test-glibc.sh를 실행하여 시스템이 취약한지 확인합니다. 2. glibc 패키지를 업데이트합니다. 3. 시스템을 재부팅하거나 영향을 받는 모든 서비스를 다시...

CVE-2025-48799

Описание Это PoC для CVE-2025-48799 — уязвимости повышения привилегий в службе обновления Windows. Данная уязвимость затрагивает клиенты Windows win11/win10 с как минимум двумя жесткими дисками. Когда на машине несколько жестких дисков, можно изменить место сохранения нового контента с помощью...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Доказательство концепции Это эксплойт доказательства концепции PoC для CVE-2023-3124, уязвимости в плагине Elementor Pro для WordPress. Описание: Плагин Elementor Pro для WordPress уязвим к несанкционированному изменению данных из-за отсутствия проверки возможностей в...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. id: CVE-2022-0422 info: name: WordPress White Label CMS 2.2.9 -...

Microweber Information Disclosure

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

UpdraftPlus < 1.22.9 - Cross-Site Scripting

The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...

TOTOLink - Unauthenticated Command Injection

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter. id: CVE-2022-25082 info: name: TOTOLink -...

WordPress Accordions - Unauthenticated Settings Update

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress. id: CVE-2022-33198 info: name: WordPress Accordions - Unauthenticated Settings Update author: riteshs4hu severity: critical description: | Unauthenticated WordPress Options Change...

Users Ultra <= 3.1.0 - SQL Injection

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the datatarget parameter before it is being interpolated in an SQL statement and then executed via the ratingvote AJAX action available to both unauthenticated and authenticated users, leading to an SQL Injection...

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

WordPress Super Socializer <7.13.30 - Cross-Site Scripting

WordPress Super Socializer plugin before 7.13.30 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the urls parameter in its thechampsharingcount AJAX action available to both unauthenticated and authenticated users before outputting it back in the response...