parameth

parameth This tool can be used to brute discover GET and POST parameters Often when you are busting a directory for common files, you can identify scripts for example test.php that look like they need to be passed an unknown parameter. This hopefully can help find them. example scan The -off flag...

parameth

parameth 该工具可用于暴力发现GET和POST参数 通常，当你在目录中爆破常见文件时，可能会识别出一些看起来需要传入未知参数的脚本（例如test.php）。该工具有望帮助你找到这些参数。 示例扫描 -off 标志允许你指定一个偏移量（有助于处理动态页面），例如，如果你得到交替的响应大小4444和4448，将偏移量设为5，工具将仅显示超出正常范围的内容。 安装 virtualenv venv . ./venv/bin/activate pip install -u -r requirements.txt 用法 usage: parameth.py -h -v -u URL -p...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye 远程代码执行 RCE CVE-2025-60787 的专业概念验证 PoC，这是 MotionEye（版本 ≤ 0.43.1b4）中的一个严重远程代码执行 RCE 漏洞。 技术概述 该漏洞源于 configUiValid JavaScript 函数中的客户端验证绕过。虽然 UI 验证了文件名字段，但服务器端在将这些输入写入 camera-N.conf 文件之前未能正确清理它们。攻击者可以通过 imagefilename 参数注入任意 shell 命令，导致在服务重新加载或重启时完全控制系统。 安装 按照以下步骤设置环境和漏洞利用工具：...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Magnus Billing v7 Inyección de Comandos PoC Vulnerabilidad de inyección de comandos no autenticados en Magnus Billing v7.3.0. El parámetro GET democ en icepay.php se pasa directamente a una función de shell sin sanitización, permitiendo la ejecución arbitraria de comandos como el...

CVE-2023-1454-EXP

JeecgBoot SQL（CVE-2023-1454）exp 1.漏洞详情 jeecg-boot 3.5.0版本存在SQL注入漏洞，该漏洞源于文件 jmreport/qurestSql 存在安全问题， 通过参数 apiSelectId 导致SQL注入。 2.使用方法 python3 CVE-2023-1454.py optional arguments: -h, --help show this help message and exit -u URL, --url URL Specify the base URL --current-db View current database...

CVE-2023-34837

CVE-2023-34837 — eScan 管理控制台：反射型跨站脚本（XSS） 概述 CVE-2023-34837 是在 Microworld Technologies eScan 管理控制台 14.0.1400.2281 版本中发现的一个 反射型跨站脚本（XSS） 漏洞。该漏洞存在于 未管理计算机 → 网络计算机 功能中的 GrpPath POST 参数中。由于用户提供的输入会在服务器响应中原样反射，且缺乏充分的清理或输出编码，攻击者可以构造恶意请求，导致任意 JavaScript 在受害者的浏览器会话中执行。 反射型 XSS 漏洞在管理控制台中尤为危险，因为：...

CVE-2023-34632

CVE-2023-34632 1000projects Book Management System 1.0 中的反射型 XSS CVE-2023-34632 1000projects Book Management System 1.0 中的反射型跨站脚本（XSS） 描述 在 1000projects Book Management System 1.0 中发现了一个反射型跨站脚本（XSS）漏洞。该漏洞存在于搜索功能（index.php）中，用户通过 search 参数提供的输入会在 HTTP 响应中被直接反射，且未进行适当的净化或输出编码。 攻击者可以构造包含 JavaScript...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS 批量赋值权限提升 📌 项目描述 CVE-2025-2304 是 Camaleon CMS（版本 2.9.1）中的一个批量赋值（Mass Assignment）漏洞，允许已认证用户通过操纵密码更改请求中的 role 参数，将其权限提升为管理员。 🚨 技术漏洞解释 漏洞背景 Camaleon CMS 使用 Ruby on Rails，在 2.9.0 版本中，UsersControllerupdatedajax 控制器存在批量赋值 漏洞。该控制器使用了无限制的 .permit!，允许请求中发送的任何参数直接赋值给用户模型。 攻击向量 1...

CVE-2026-6356

Augmentt：通过参数篡改实现权限提升 致谢 本 CVE 是以下人员合作完成的： HelloWorld （作者）– GitHub：https://github.com/Penquinsecq Raznov – GitHub：https://github.com/basraznov 描述 该 Web 应用程序中存在一个漏洞，允许普通用户通过参数篡改将其权限提升至超级管理员级别，从而能够访问和修改敏感信息。 !CAUTION本研究以教育和防御为目的发布。这些漏洞已在发布前进行了负责任地披露和协调处理。 产品 ：Augmentt Web 应用程序 版本 ：版本未知，但于 2025 年 10...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

PT-2026-104252

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104465: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-104441: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

CVE-2026-85016: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

PT-2026-104207

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Dart bindings contain an issue involving improper handling of length parameter inconsistency, which can lead to memory allocation with an excessive size value. Recommendations...

CVE-2026-94633: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94635: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...