232 matches found
honeypot-dlink-CVE-2024-3273
honeypot-dlink-CVE-2024-3273 CVE-2024-3273 के लिए त्वरित और सरल हनीपॉट। इस टेम्पलेट का उपयोग 10 मिनट में एक बुनियादी हनीपॉट स्थापित करने के लिए किया जा सकता है। संक्षेप में: खोजें fofa, shodan, onyphe, ...। इसे wgetclonehttp.sh से क्लोन करें। हनीपॉट को अधिक यथार्थवादी बनाने के लिए मैन्युअल समायोज...
CVE-2019-19033
CVE-2019-19033: Jalios JCMS 10 बैकडोर खाता / प्रमाणीकरण बाईपास I. भेद्यता Jalios JCMS 10 हमलावरों को किसी भी उपयोगकर्ता नाम और एक विशिष्ट पासवर्ड का उपयोग करके एक बैकडोर खाते के माध्यम से वेबसाइट और WebDAV सर्वर के किसी भी भाग तक प्रशासनिक विशेषाधिकारों के साथ पहुंचने की अनुमति देता है। II. CVE...
DblTekGoIPPwn
DblTekGoIPPwn أداة لاستغلال نظام التحدي والاستجابة في أجهزة DblTek GoIP الضعيفة. يمكنها توليد استجابات لتحديات محددة، واختبار المضيفين لوجود الثغرة، وتنفيذ الأوامر على المضيفين الضعفاء، وإرسال رسائل SMS من مضيف، والدخول إلى شل جذر على أي مضيف ضعيف. الثغرة في 2 مارس 2017، نشرت Trustwave ثغرة اكتشف...
vuln-chain-lab
फ़ाइल अपलोड बाइपास + स्टोर्ड XSS PoC लैब एक जानबूझकर कमजोर वेब एप्लिकेशन जो दर्शाता है कि कैसे फ़ाइल अपलोड बाइपास स्टोर्ड XSS के साथ मिलकर बैकडोर एडमिन खाते बनाता है, भले ही CSP, CORS और CSRF सुरक्षाएँ मौजूद हों। पूरा ब्लॉग पोस्ट: KurtiseBear ब्लॉग यह एक शैक्षणिक लैब है जो रक्षात्मक सुरक्षा...
KevinLAB BEMS (Building Energy Management System) - Backdoor Account
KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...
D-Link Network Attached Storage - Backdoor Account
A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...
dlink
حقن الأوامر وحساب باب خلفي في أجهزة D-Link NAS ملخص الثغرة: تصف الثغرة المذكورة أجهزة D-Link NAS متعددة، بما في ذلك الموديلات DNS-340L وDNS-320L وDNS-327L وDNS-325، وغيرها. تكمن الثغرة داخل URI الخاص بـ nassharing.cgi ، والذي يُعد عرضة للاختراق بسبب مشكلتين رئيسيتين: باب خلفي تسهّله بيانات اعتماد...
CVE-2024-29972
TG हमसे जुड़ें https://t.me/WanLiChangChengWanLiChang हमसे जुड़ें और समय-समय पर विभिन्न कमजोरियों के EXP और POC प्राप्त करें CVE-2024-29972-EXP CVE-2024-29972 Zyxel Nas Backdoor Account बैकडोर खाता अनधिकृत रूप से खोला गया FOFA app="ZyXEL-NAS326" महत्वपूर्ण नोट्स यह EXP स्क्रिप्ट CVE-2024-29972 और...
CVE-2026-52520
Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...
D-Link Network Attached Storage - Command Injection and Backdoor Account
UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument...
CVE-2025-71317 NetMan 204 Hard-coded Backdoor Credentials
NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax...
CVE-2026-42289
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an...
CVE-2020-37135
AMSS++ 4.7 is affected by an authentication bypass that lets attackers access administrative accounts using hardcoded credentials (default admin/admin or admin/1234 depending on source), enabling unauthorized admin access. The vulnerability is documented across multiple feeds (CVE-2020-37135) wit...
CVE-2020-37135 AMSS++ 4.7 - Backdoor Admin Account
AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can log in with the default admin username and password '1234' to gain unauthorized administrative access to the system...
CVE-2023-53895
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account,...
CVE-2023-53895
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account,...
CVE-2023-53895 PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account,...
PT-2025-51743
Name of the Vulnerable Software and Affected Versions PimpMyLog version 1.7.14 Description The software contains an improper access control issue that allows remote attackers to create administrator accounts without authorization through the configuration endpoint. Attackers can exploit the...
