CVE-2018-6574

此存储库没有 README。...

fortiscan

Fortiscan CVE-2018-13379 FG-IR-18-384 Exploitation Tool, You can use this tool to check the vulnerability in your FortiGate SSL-VPN. This vulnerability affects the following versions: • FortiOS 6.0 - 6.0.0 to 6.0.4 • FortiOS 5.6 - 5.6.3 to 5.6.7 • FortiOS 5.4 - 5.4.6 to 5.4.12...

fortiscan

Fortiscan CVE-2018-13379 FG-IR-18-384 脆弱性悪用ツール このツールを使用して、FortiGate SSL-VPN の脆弱性を確認できます。 この脆弱性は以下のバージョンに影響します： • FortiOS 6.0 - 6.0.0 から 6.0.4 • FortiOS 5.6 - 5.6.3 から 5.6.7 • FortiOS 5.4 - 5.4.6 から 5.4.12 https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability 重要なお知らせ 0.7...

EXP_CVE-2018-19518

CVE-2018-19518 免责声明 本程序应仅用于授权的安全测试与研究目的，请使用者遵照网络安全法合理使用。 使用者使用该工具出现任何非法攻击等违法行为，与作者无关。 使用 root@kitploit: python CVE-2018-19518.py 目标ip 目标port shell-ip shell-port...

perwendel__spark_CVE-2018-9159_2_7_2_fixed

Spark: un micro framework web para Java 8 NOTICIAS : Spark 2.7.1 ya está disponible. Pruébalo y reporta cualquier error. root@kitploit: com.sparkjava spark-core 2.7.1 Importante: existe una vulnerabilidad en versiones antiguas de Spark versiones anteriores a la 2.5.2. Actualiza a la última versió...

ble_norton_core

Norton Core Secure WiFi 路由器 BLE 服务命令注入 PoC CVE-2018-5234 更多信息请阅读 论文。 为了演示利用过程，我们将使用： 操作系统 GNU/Linux； 蓝牙适配器； BlueZ 工具（用于测试蓝牙连接）。 为了使用脚本，我们需要提前安装所有依赖： root@kitploit: $ pip install -r ./requirements.txt 借助 BlueZ 工具，应确保蓝牙已启用且功能正常。 1. 重启路由器以访问工程页面。 2. 以 root 用户身份启动 PoC（操作蓝牙所需），并将要执行的命令作为参数传入：...

CVE-2018-17144_POC

此存储库没有 README。...

Identificador-CVE-2018-11759

他の言語 git - pt-BR インスタンスがCVE-2018-11759にさらされているか確認してください mainアーカイブは、エクスプロイト用のbashスクリプトです。 URLはプロトコルと完全なアドレスを使用する必要があります。例: https://test.site.com.br 複数のURLを一度に確認するには、ヒアドキュメントを使用できます。例: root@kitploit: Call the bash, no request permission for exec bash main EOF https://vulpagepagevul.com...

CVE-2018-7211-PoC

CVE-2018-7211-PoC CVE-2018-7211 的 PoC||GTFO 参考: https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/ 要求 无，仅需 Python 使用方法 运行脚本 root@kitploit: $ git clone https://github.com/bowline90/CVE-2018-7211-PoC.git $ cd CVE-2018-7211-PoC $ chmod +x PoCedcrypt.py $ .\PoCedcrypt.py string...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting

Adiscon LogAnalyzer before 4.1.7 contains a cross-site scripting vulnerability in the 'referer' parameter of the login.php file. id: CVE-2018-19877 info: name: Adiscon LogAnalyzer 4.1.7 - Cross-Site Scripting author: arafatansari severity: medium description: | Adiscon LogAnalyzer before 4.1.7...

Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

SugarCRM 3.5.1 - Cross-Site Scripting

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. id: CVE-2018-5715 info: name: SugarCRM 3.5.1 - Cross-Site Scripting author: edoardottt severity: medium description: SugarCRM 3.5.1 is vulnerable to cross-site...

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter. id: CVE-2018-5316 info: name: WordPress SagePay Server Gateway for WooCommerce 1.0.9 - Cross-Site Scripting author: daffainfo severity: medium...

ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection

ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the albumid parameter in the /photo-gallery/api/album/treelists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. id: CVE-2018-9205 info: name: Drupal avataruploader v7.x-1.0-beta8 - Local File Inclusion author: daffainfo severity: high description: In avataruploader...

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/category.php CatagoryName and StakeHolder parameters. id: CVE-2018-20011 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD through version...

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begindate, enddate, or formid parameters. This can allow an attacker to steal cookie-based authentication credentials a...