cve-2019-0227

cve-2019-0227 apache axis1.4远程代码执行漏洞 需要在本机msf设置监听，另外需要修改代码24-30行处 ＃您需要更改这些变量以匹配您的配置 myip = “ 192.168.0.117 ” ＃您机器的IP target = “ 192.168.0.102 ” ＃目标IP 网关= “ 192.168.0.1 ” ＃默认网关 targetport = “ 8080 ” ＃目标运行轴的端口（可能是8080） pathtoaxis = “ http://192.168.0.102:8080/axis ” ＃这可以是自定义的视轴安装，但是这是默认...

cve-2021-3864

CVE-2021-3864 のテスト 実行方法 ユーザーを作成する echo ALL= path/to/gen-core /etc/sudoers sysctl kernel.corepattern=core ./cve-2021-3864 /etc/logrotate.d にコアファイルが生成されるはずです...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons（バージョン1.13～1.13.10、2.0～2.0.5、およびサポート終了の古いバージョン）には、特殊要素の不適切な無害化に起因するプロパティバインダーの脆弱性が存在します。認証されていないリモートの悪意あるユーザー（攻撃者）は、Spring Data RESTがバックエンドとするHTTPリソースに対して特別に細工されたリクエストパラメータを送信するか、Spring Dataのプロジェクションベースのリクエストペイロードバインディングを利用することで、リモートコード実行攻撃につながる可能性があります。 詳細はこちら 実行...

CVE-2025-25257

목차 개요 취약점 세부 정보 개념 증명 PoC Trolled2 Trolled3 개요 CVE-2025-25257는 사전 인증 SQL 인젝션 취약점 으로, Fortinet FortiWeb Fabric Connector 버전 7.0부터 7.6.x까지 영향을 미칩니다. 이 결함을 통해 공격자는 취약한 API 엔드포인트에 악의적인 SQL 명령을 주입할 수 있으며, 잠재적으로 원격 코드 실행RCE으로 이어질 수 있습니다. 이 저장소는 SQL 인젝션 벡터를 안전하고 통제된 방식으로 설명하는 PoC 를 포함하고 있습니다. 오픈 소스로 제공되...

Oracle-WebLogic-CVE-2017-10271

WebLogic Wls-wsat XMLDecoder 脆弱性の説明 mitre:https://vulners.com/cve/CVE-2017-3506 初期に、ハッカーはWebLogic WLSコンポーネントの脆弱性を利用して企業サーバーに対して大規模なリモート攻撃を仕掛け、多数の企業のサーバーが侵害されました。被害を受ける企業数は明らかに増加傾向にあり、高い注意が必要です。CVE-2017-3506は、Oracle...

cve-2021-41773

cve-2021-41773 サーバーの起動 $ docker build -t cve-2021-41773 . $ docker run --rm -d -p 80:80 cve-2021-41773 エクスプロイト curl --data "echo;id" 'http://localhost/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd' 原因 httpd.conf ファイルの設定ミスとパストラバーサルの組み合わせによる RCE...

WAGO-CVE-2023-1698

WAGO-CVE-2023-1698 WAGOシステムリモートコード実行の脆弱性（CVE-2023-1698） 注意 私はローカルテストおよびPOC開発用のツールを作成しました。これは技術学習の参考のみを目的としています。違法な目的には使用しないでください。この記事で提供される情報を個人または組織が使用したことによる直接的・間接的な結果および損失は、すべて利用者自身の責任であり、作者とは一切関係ありません!!! 説明...

Sitecore Experience Platform - Deserialization of Untrusted Data

Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability CVE-2019-9874. An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the...

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

WordPress InPost Gallery <2.1.4.1 - Local File Inclusion

WordPress InPost Gallery plugin before 2.1.4.1 is susceptible to local file inclusion. The plugin insecurely uses PHP's extract function when rendering HTML views, which can allow attackers to force inclusion of malicious files and URLs. This, in turn, can enable them to execute code remotely on...

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter. id: CVE-2021-39316 info: name: WordPress DZS Zoomsounds =6.51 to fix t...

WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload

WordPress eaSync Booking plugin bundle for hotel, restaurant and car rental before 1.1.16 is susceptible to arbitrary file upload. The plugin contains insufficient input validation of an AJAX action. An allowlist of valid file extensions is defined but is not used during the validation steps. An...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade via manipulation of the argument key. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised...

Thinkphp Lang - Local File Inclusion

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php. id:...

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

Ruby Dragonfly <1.4.0 - Remote Code Execution

Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishand...

Jenzabar 9.2x-9.2.2 - Cross-Site Scripting

Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search&query. id: CVE-2021-26723 info: name: Jenzabar 9.2x-9.2.2 - Cross-Site Scripting author: pikpikcu severity: medium description: Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. id: CVE-2022-30777 info: name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting author: 3th1cyuk1 severity: medium description: | Parallels H-Sphere 3.6.1713 contains a cross-site...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the traceroute function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic...