1312 matches found
CVE-2024-42327
PoC para CVE-2024-42327 / ZBX-25623 Una cuenta de usuario no administrador en el frontend de Zabbix con el rol de Usuario predeterminado, o con cualquier otro rol que otorgue acceso a la API, puede explotar esta vulnerabilidad. Existe un SQLi en la clase CUser en la funciΓ³n addRelatedObjects; est...
CVE-2019-14537
YOURLS: PoC de CVE-2019-14537 Cuando obtengas una marca de tiempo vΓ‘lida, podrΓ‘s realizar solicitudes a la api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats×tamp=VALIDTIMESTAMP Uso usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip CVE-2019-14537 P...
CVE-2025-24016
Wazuh EjecuciΓ³n Remota de CΓ³digo RCE - PoC Resumen de la Vulnerabilidad Este repositorio demuestra la vulnerabilidad de ejecuciΓ³n remota de cΓ³digo RCE en el servidor Wazuh, introducida por una deserializaciΓ³n insegura en el paquete wazuh-manager. La vulnerabilidad permite a atacantes remotos con...
CVE-2023-35078
Herramienta de ExplotaciΓ³n CVE-2023-35078 βββββββ ββββ βββββββββββββββββββ βββββββ ββββββββββββββ βββββββββββββββββββββββββββ βββββββββββββββ βββββββββββββββββ βββ βββββββββββββββββββββββββββββββββ βββ ββββββββββββ ββββββββββββββββββββββββββββββ βββββββ βββ βββββββββββββββββββββ βββββββ +...
strelka-ui
Releasesrelease | Pull Requestspr | Issuesissues !GitHub releaseimg-version-badgerepo !Build Statusimg-actions-badgeactions-ci !Pull Requestsimg-pr-badgepr !Slackimg-slack-badgeslack !Licenseimg-license-badgelicense La Interfaz Web de Strelka es un frontend de envΓo de archivos basado en navegado...
CVE-2024-28987
CVE-2024-28987 ExplotaciΓ³n de Prueba de Concepto para CVE-2024-28987: Vulnerabilidad de Credenciales Codificadas en SolarWinds Web Help Desk Resumen Extrae hasta 25 tickets mΓ‘s recientes limitaciΓ³n de la API Recupera los detalles completos de cada ticket Analiza los IDs de los tickets para estima...
CVE-2026-105835
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...
EUVD-2026-93379
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...
MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...
CVE-2023-35078
CVE-2023-35078 shodan dorks You can use the following shodan dorks to find public targets. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs You can use the following to transform data from shodan API to format suitable for the checking script: jq -cr 'select.http.favicon.hash ==...
PT-2026-106717
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...
CVE-2025-13315
π‘οΈ CVE-2025-13315 - Bypass de AutenticaciΓ³n CrΓtico en Twonky Server 8.5.2 -e63939?style=for-the-badge Un atacante no autenticado puede eludir la autenticaciΓ³n de la API, filtrar credenciales de administrador de los registros y obtener acceso completo de administrador. π Resumen CVE-2025-13315 es...
CVE-2025-49132-PoC
Guide to use script that exploit the Pterodactyl Path Traversal at locale.json Requirements Exposed Redis Server Panel URL Guide 1. Get access to the server configuration file, which has APPKEY and Redis Database Password + IP 2. Use forgecookie to generate a pterodactylsession cookie 3. Use that...
Wipro Holmes Orchestrator 20.4.1 - Information Disclosure
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
CVE-2026-51954
Product: Webasyst Framework Affected Version: β€ 4.0.3 Severity: High CVSS 3.1: 8.0 Description Webasyst Framework through 4.0.3 contains an OAuth 2.0 implementation flaw that allows a remote, unauthenticated attacker to intercept authorization credentials issued during the OAuth flow, without...
CVE-2023-35078-Exploit-POC
CVE-2023-35078 Exploit POC CVE-2023-35078 Remote Unauthenticated API Access vulnerability has been discovered in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron Core. This vulnerability impacts all supported versions β Version 11.4 releases 11.10, 11.9 and 11.8. Older...
CVE-2023-42442
CVE-2023-42442 CVE-2023-42442 Vulnerabilidad de descarga arbitraria de grabaciones de sesiΓ³n de JumpServer DescripciΓ³n de la vulnerabilidad CVE-2023-42442 es una vulnerabilidad combinada que incluye dos errores en Jumpserver 1. Acceso no autorizado a la API que filtra informaciΓ³n de sesiΓ³n 2...
CVE-2026-82042
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...
CVE-2026-82042 UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...
EUVD-2026-91797
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...