145 matches found
GLPwn
GLPwn A GLPI 黑客工具，利用 Apache 目录列表和/或 CVE-2020-15175 来转储文件和有效会话。 谁受影响？ 任何已在 /files 文件夹上启用 Apache 目录列表的 GLPI 实例 所有在默认 Apache2 服务器上运行的 9.5.1 之前的 GLPI 实例。 它能做什么？ GLPwn 能够转储 GLPI /files 文件夹中的所有文件，包括管理员会话、日志、数据库转储和工单附件。 GLPwn 还能自动检测哪个会话有效、在平台上拥有最高权限，以及会话用户的名称。 免责声明 此工具利用了 GLPI...
CVE-2021-41773
CVE-2021-41773 Apache HTTP服务器漏洞（仅影响2.4.49版本） 需求设置 httpd.conf root@kitploit: ... LoadModule cgimodule modules/modcgi.so 取消注释这一行 ... AllowOverride none Require all denied 注释掉这一行或设置为Require all granted ... 参考 https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis...
EUVD-2026-70850
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall (CSF) by WebPros maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host . A remote unauthenticated attacker whose address is blocked by CSF can request a mapped executable and run arbitrary commands as the Apa...
CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67178
CVE-2026-67178 affects MISP installations where Apache virtual-host redirects were generated without a trailing slash, causing an open redirect vulnerability. The Redirect directive uses the destination as a host if the trailing slash is missing, enabling an attacker to craft URLs like http://mis...
PT-2026-40942
Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...
CVE-2026-33704
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user including students can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are...
CVE-2026-33704
CVE-2026-33704 affects Chamilo LMS prior to version 1.11.38. An authenticated user (including students) can use the BigUpload endpoint to write arbitrary content to server files: the key parameter selects the filename and the raw POST body becomes the file contents. Although .php extensions are f...
CVE-2026-35573 ChurchCRM has a Path traversal leads to RCE
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The...
ChurchCRM 代码问题漏洞
ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 6.5.3 had code vulnerabilities. These vulnerabilities stemmed from path traversal vulnerabilities in the backup restoration function, which could allow authenticated administrators to upload arbitrary...
CVE-2026-34381
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on admmyfiles/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently igno...
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
Summary Admidio relies on admmyfiles/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module regardles...
CVE-2026-34381 Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on admmyfiles/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently igno...
CVE-2026-27636
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in app/Misc/Helper.php does not include .htaccess or .user.ini files. On Apache servers with AllowOverride All a common configuration, an...
EUVD-2026-8612
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in app/Misc/Helper.php does not include .htaccess or .user.ini files. On Apache servers with AllowOverride All a common configuration, an...
CLSA-2026-1769013944 httpd: Fix of 2 CVEs
CVE-2025-66200: don't use request notes for suexec, stop accepting the obscure "note" option in RequestHeader - CVE-2025-65082: fix precedence of envvars from HTTP headers and Apache configuration...