CVE-2019-7192_QNAP_Exploit

Exploitation RCE Root Pré-Auth QNAP CVE-2019-7192 CVE-2019-7195 pour l'instant, vous pouvez lire les fichiers système /etc/shadow, clé privée SSH, etc. Utilisation : root@kitploit: pip install -r requirements.txt ou simplement pip install requests python3 gundy.py https://urlvulnérable:port Exemp...

cve-2019-7192-check

Vérificateur QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Utilisation : root@kitploit: pip install requests ./CheckerforQNAPRCEcve2019719295.py /path/to/ip-port.txt Exemple de fichier en entrée : root@kitploit: 1.2.3.4 8080 2.3.4.5 443 Cet outil prend une liste d'IPs et de ports de NAS QNAP...

CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE요약: 이 설명은 FreePBX 16의 두 취약점CVE-2025-57819 및 CVE-2025-61678을 결합하여 인증되지 않은 액세스에서 원격 코드 실행Remote Code Execution, RCE으로 권한을 상승시키는 전체 공격 체인을 보여줍니다. 취약점 CVE 정보 CVE 번호 영향 구성 요소 영향 및 취약점 유형 CVE-2025-57819 Endpoint 모듈 로더brand 매개변수 인증되지 않은 다중 명령 SQL 주입Unauthenticated...

CVE-2026-63030-CVE-2026-60137

CVE-2026-63030 & CVE-2026-60137 — wp2shell RCE pré-auth du noyau WordPress — Confusion de route + injection SQL enchaînées pour aboutir à une exécution de code à distance...

wp2shell

wp2shell — RCE sans authentification sur le cœur de WordPress CVE-2026-63030 Confusion de route Batch, CVSS 7.5 + CVE-2026-60137 Injection SQL, CVSS 9.1 Une chaîne d'exécution de code à distance sans authentification dans le cœur de WordPress, qui ne nécessite aucun plugin, aucune configuration...

CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning

CVE-2024-4879 和 CVE-2024-5217 ServiceNow RCE 扫描 使用 Nuclei 和 Shodan Dork 扫描 CVE-2024-4879 和 CVE-2024-5217 ServiceNow RCE 漏洞。 漏洞信息资源 https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data 使用方法 nuclei -t CVE-2024-4879-Detect-Database-ServiceNow.yaml -l...

CVE-2019-9745

Auteur: Arn Vollebregt Introduction La créativité est au cœur du test de pénétration, ce qui rend notre travail intéressant. Cependant, un écueil est la tendance à « sur-ingénier » les scénarios d'attaque et à se concentrer uniquement sur les bugs conditions d'erreur. Les défauts comportements no...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — Неаутентифицированная SQLi до RCE Эксплойт типа proof-of-concept, объединяющий две уязвимости FreePBX для перехода от нулевого доступа к удаленному выполнению кода на FreePBX 16...

wp2shell-poc-fulljs

Démonstration du flux logique des CVE de WordPress Vue d'ensemble Ce projet permet de reproduire le flux logique lié aux CVE-2026-63030 et CVE-2026-60137, menant à une injection SQL servant de base pour finalement déclencher une RCE dans WordPress. CVE-2026-63030 CVE-2026-60137 La démonstration...

pwn2own2020

Compromettre le noyau macOS via Safari en enchaînant six vulnérabilités Aperçu Ce dépôt contient les détails d'exploitation et techniques de notre soumission gagnante du Pwn2Own 2020 ciblant Apple Safari avec une élévation de privilèges du noyau pour macOS 10.15.3. Pour plus d'informations, vous...

CVE-2023-53979 MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities

MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration...

FICO Origination Manager Decision Module 4.8.1 XSS / Session Hijacking Vulnerabilities

Multiple persistent cross site scripting vulnerabilities in FICO Origination Manager Decision Module version 4.8.1 allow an attacker to execute code in the context of the victim's browser using a crafted payload. Additionally, an attacker with initial access to the application, can get the...

SUSE CVE-2020-25684

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query,...

MyBB 1.8.25 - Poll Vote Count SQL Injection

Exploit Title: MyBB 1.8.25 - Poll Vote Count SQL Injection Exploit Author: SivertPL [email protected] Date: 20.03.2021 Description: Lack of sanitization in the "votes" parameter in "Edit Poll" causes a second-order semi-blind SQL Injection that is triggered when performing a "Move/Copy"...

MyBB 1.8.25 - Chained Remote Command Execution

Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution Exploit Author: SivertPL [email protected] Date: 19.03.2021 Description: Nested autourl Stored XSS - templateset second order SQL Injection leading to RCE through improper string interpolation in eval. Software Link:...

MyBB 1.8.25 Remote Command Execution

Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution Exploit Author: SivertPL [email protected] Date: 19.03.2021 Description: Nested autourl Stored XSS - templateset second order SQL Injection leading to RCE through improper string interpolation in eval. Software Link:...

h1-ctf: [h1-2006 2020] Chained vulnerabilities lead to account takeover

Summary Mårten Mickos lost his account for BountyPay, the new service HackerOne is using to pay bug bounties. In this report I explain how I accessed a customer's account using a log file and bypassed its 2FA validation. I then leverage an open redirect bug to gain access to an internal server an...

h1-ctf: [H1-2006 2020] CTF Writeup

Summary: The CTF's objective could be found in the following Twitter post: F858468 As outlined on https://hackerone.com/h1-ctf, all subdomains of bountypay.h1ctf.com are in scope. Doing subdomain enumeration revealed the following subdomains: api.bountypay.h1ctf.com app.bountypay.h1ctf.com...

h1-ctf: [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret document

Hi! Summary Multiple chained vulnerabilities lead to leaking secret documents. Improper sanitization in registration allows an attacker to create a QR recover code for any email address. This leads to an account takeover. Using that technique on jobert's account, attacker can access the support...

Uber: Chained vulnerabilities create DOS attack against users on desafio5estrelas.com

On a vendor created and managed site desafio5estrelas.com, by controlling the value of the gender parameter on the /salvargenero endpoint via CSRF, an attacker was able to prevent a user from ever logging into their account again. Fun chained CSRF that caused a DOS on user’s account. Check out my...