58389 matches found
WordPress JSmol2WP <=1.07 - Local File Inclusion
WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context...
BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting
BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML. id: CVE-2018-16139 info: name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting author:...
Schneider Electric U.motion Builder - SQL Injection
The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...
Monstra CMS 3.0.4 - HTTP Header Injection
Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...
Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion
Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences /../, conduct directory traversal attacks, and view arbitrary files. id: CVE-2018-19326 info: name: Zyxel VMG1312-B10D...
Cobbler - Authentication Bypass
Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...
Zeit Next.js < 4.2.3 - Local File Inclusion
Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2018-6184 info: name: Zeit Next.js =4.2...
DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php. id: CVE-2018-19136 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting v...
DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 is vulnerable to reflected cross-site Scripting via assets/edit/ip-address.php. id: CVE-2018-19137 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 is vulnerable to reflected cross-site Scripting via...
Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion
Cybrotech CyBroHttpServer 1.0.3 is vulnerable to local file inclusion in the URI. id: CVE-2018-16133 info: name: Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion author: 0xAkoko severity: medium description: Cybrotech CyBroHttpServer 1.0.3 is vulnerable to local file inclusion in the URI...
Jorani Leave Management System 0.6.5 - Cross-Site Scripting
Persistent cross-site scripting XSS issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language. id: CVE-2018-15917 info: name: Jorani Leave Management System 0.6.5 - Cross-Site Scripting author: ritikchaddha severity: medium...
Pingpon-Exploit
PINGPON EXPLOIT Author: @037 Pingpon is a tool used to obtain thousands of vulnerable GPON home routers using Shodan.io to then execute any Linux command on using a remote code execution flaw CVE-2018-10562. DISCLAIMER I am NOT responsible for any damages caused or any crimes committed by using...
CVE-2018-1111
CVE-2018-1111 CVE-2018-1111 DynoRoot...
napper-for-tpm
root@kitploit: ,----------------, ,---------, ,-----------------------, ," ,"| ," Napper v1.3 for TPM ," | ," ," | +-----------------------+ | ," ," | | .-----------------Z | | +---------+ | | | Z | | | | -==----'| | | | ︶ ︶ z | | | | | | | | - | | |/----| ==== oo | | | | | | | ,/| | ," |...
CVE-2018-6574
В этом репозитории нет README...
domato
Domato 🍅 A DOM fuzzer Written and maintained by Ivan Fratric, [email protected] Copyright 2017 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License ...
CVE-2018-1273
CVE-2018-1273 CVE-2018-1273 환경 CVE-2018-1273: Spring Data Commons에서의 RCE https://pivotal.io/security/cve-2018-1273 애플리케이션 https://github.com/spring-projects/spring-data-examples/tree/master/web/example 빌드 root@kitploit: $ docker build -t cve-2018-1273 . 실행 root@kitploit: $ docker run -d -p...
CVE-2018-9995_check
CVE-2018-9995check Массовое обнаружение камер серии DVR Метод использования:python CVE-2018-9995.py host.txt Где содержимое host.txt может быть 8.8.8.8:8080 или www.baidu.com, после запуска скрипта хосты, использующие камеры серии DVR, будут сохранены в файл result.txt Инструмент эксплуатации...