CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】Kontoübernahme via XSS Details Es liegt eine Sicherheitslücke vor, die beim Herunterladen von Dateien zu XSS führt. Die XSS-Sicherheitslücke könnte es einem Teedy-Administrator ermöglichen, mit wenigen Klicks ein Konto zu übernehmen. Diese...

CVE-2023-2825-Gitlab

CVE-2023-2825 Il 23 maggio 2023, GitLab ha rilasciato la versione 16.0.1 che ha corretto una vulnerabilità critica, CVE-2023-2825, che interessava la versione 16.0.0 della Community Edition CE e della Enterprise Edition EE. La vulnerabilità consente a utenti non autenticati di leggere file...

CVE-2024-25641

CVE-2024-25641 RCE per Cacti 1.2.26 Questo repository automatizza il processo di sfruttamento di CVE-2024-25641 su Cacti 1.2.26. Quando un utente è autenticato, una vulnerabilità di scrittura arbitraria di file, sfruttabile attraverso la funzione "Package Import", consente agli utenti autenticati...

CVE-2021-41773

Angreifbare Docker-Images für CVE-2021-41773 Apache-Pfad-Traversal Diese Schwachstelle gilt nur für Version 2.4.49, die bestimmte nicht-standardmäßige Konfigurationen haben. In bestimmten Situationen kann dies entweder zu Dateiauslese oder Codeausführung führen...

xz-utils-vuln-checker

root@kitploit: / / / / | |/// / / / / / / / / / / / / / / //// // / / / / / / / //|| // ,/ / // // // Hare Krishna Rai 0xblurr3d / / / / / / | | / / / / / / / / / \ / / / \ / \ / / / /// / \ / / | |/ / / // / / / / / / //// / / / / // // / / , / / / / |/ ,/ // // // / // // / / //|| / //...

CVE-2020-12116

CVE-2020-12116 Codice proof-of-concept per sfruttare CVE-2020-12116: lettura arbitraria di file non autenticata su ManageEngine OpManger. Riepilogo L'ultima versione di OpManager contiene una vulnerabilità di directory traversal che consente l'accesso illimitato a tutti i file nell'applicazione...

CVE-2018-12613

CVE-2018-12613 Bug di inclusione locale di file dovuto al bypass del filtro utilizzando il carattere %253f. Software interessato 1. PHPMyAdmin v.4.8.0 2. PHPMyAdmin v.4.8.1 Come usare Questo script PowerShell necessita di tre parametri per creare una richiesta HTTP di exploit: root@kitploit: 1...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

sap_igs_xxe

SAP IGS XXE-Angriff CVE-2018-2392 und CVE-2018-2393 Dieses Modul im Metasploit Framework Dokumentation Modul Verwundbare Anwendung Dieses Modul nutzt CVE-2018-2392 und CVE-2018-2393 aus, zwei XXE-Sicherheitslücken in der XMLCHART-Seite von SAP Internet Graphics Servern IGS der Versionen 7.20,...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS RCE non autenticata tramite caricamento di file di grandi dimensioni Questo repository contiene una Proof of Concept PoC per CVE-2023-4220 , una vulnerabilità di Remote Code Execution RCE che affligge Chamilo LMS. Questa vulnerabilità consente ad attaccanti non...

LFiFreak

LFI Freak ============= Caratteristiche Funziona con Windows, Linux e OS X Include bind shell e reverse shell sia per Windows che per Linux Scritto in Python 2.7 Di cosa si tratta? Uno strumento unico per sfruttare le inclusioni locali di file utilizzando i metodi PHP Input, PHP Filter e Data URI...

CVE-2026-77693

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-75797

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...

CVE-2025-0411-PoC

अधिक PoC देखें: https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X MinGW-w64 का उपयोग करके cpp संकलन करें x8664-w64-mingw32-g++ loader.cpp -o loader.exe -s -static संकलन के बाद exe को 7z से संपीड़ित करें और दो बार निष्पादित करें चूँकि इस भेद्यता के लिए उपयोगकर्ता की सहभागिता आवश्यक है, इसलिए...

cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ =3.0.0 से 4.3.4 तक स्थानीय और नेटवर्क फ़ाइलों को बाहरी पक्षों को उजागर करता है सारांश inMusic Brands सॉफ्टवेयर Engine DJ में एक एम्बेडेड HTTP सर्वर है जो मीडिया लाइब्रेरी फ़ाइलों को नेटवर्क पर कनेक्टेड क्लाइंट तक पहुँचाने के लिए होता है। मीडिया फ़ाइलों को...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

EUVD-2026-66287

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...