1369 matches found
Moodle Cross-Site Request Forgery Vulnerability (CNVD-2025-11157)
Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from the presence of incorrect CSRF token checks in...
Exploit for Cross-site Scripting in Salesagility Suitecrm
CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...
CyberPanel upgrademysqlstatus Arbitrary Command Execution Exploit
Proof of concept remote command execution exploit for CyberPanel versions prior to 5b08cd6. import httpx import sys def getCSRFtokenclient: resp = client.get"/" return resp.cookies'csrftoken' def pwnclient, CSRFtoken, cmd: headers = "X-CSRFToken": CSRFtoken, "Content-Type":"application/json",...
GHSA-79JV-5226-783F OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand
Summary The export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then ...
Exploit for Command Injection in Netgate Pfsense
pfSense 2.7.0 Command Injection Exploit CVE-2023-42326 This...
PT-2024-32871 · Unknown +3 · Openrefine +3
Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.8.3 Description: The issue allows an attacker to lead a user to a malicious page that submits a form POST containing embedded JavaScript code. This code would then be included in the response, along with an...
CVE-2024-38863 CSRF token leaked in URL parameters
Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35 and 2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks...
CVE-2024-38863 CSRF token leaked in URL parameters
Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35 and 2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks...
pgAdmin 8.4 Code Execution
============================================================================================================================================= | Title : pgAdmin 8.4 PHP Code Execution Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 129.0.1 64 bits ...
Limesurvey Unauthenticated File Download
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework for extracting files require 'zip' class MetasploitModule 'Limesurvey Unauthenticated File Download', 'Description' = %q This module exploits an unauthenticated file...
Postfixadmin Protected Alias Deletion
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postfixadmin Protected Alias Deletion Vulnerability', 'Description' = %q Postfixadmin installations between 2.91 and 3.0.1 do not check if an adm...
pgAdmin Binary Path API RCE
pgAdmin use exploit/windows/http/pgadminbinarypathapi msf exploitpgadminbinarypathapi show targets ...targets... msf exploitpgadminbinarypathapi set TARGET msf exploitpgadminbinarypathapi show options ...show and set options... msf exploitpgadminbinarypathapi exploit This module requires...
Build Your Own Botnet 2.0.0 Remote Code Execution Exploit
Build Your Own Botnet BYOB version 2.0.0 exploit that works by spoofing an agent callback to overwrite the sqlite database and bypass authentication and exploiting an authenticated command injection in the payload builder page. Exploit Title: BYOB Build Your Own Botnet v2.0.0 Unauthenticated RCE...
Exploit for Code Injection in Get-Simple Getsimple_Cms
CVE-2022-41544 Exploit Script This repository contains a scri...
Exploit for Code Injection in Get-Simple Getsimple_Cms
CVE-2022-41544 Exploit Script This repository contains a scri...
Security Bulletin: IBM Sterling B2B Integrator Standard Edition could disclose sensitive information in the HTTP response
Summary In IBM Sterling B2B Integrator's dashboard, many links have CSRF tokens at the end of URLs. An attacker could post something with a link to the B2Bi dashboard somewhere. If a B2Bi user who has the active http session and owns the token clicks the link then the request will be honored sinc...
PT-2024-28342 · Unknown · Limesurvey
Name of the Vulnerable Software and Affected Versions: Lime Survey versions 6.5.12 and earlier Description: The issue concerns a Cross Site Request Forgery CSRF problem. Specifically, the YII CSRF TOKEN is checked only when passed in the body of POST requests, but this check is not performed for...
Moodle Cross-Site Request Forgery Vulnerability (CNVD-2025-11217)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from incorrect CSRF token checking, which can be exploited by...
