modsecurity-backdoor

Backdoor ModSecurity Descrizione Questa è una prova di concetto di software dannoso in esecuzione all'interno del WAF ModSecurity. Il software ha due funzioni principali: Recupero del contenuto di file. Esecuzione di comandi e recupero dell'output shell remota. Inoltre, include queste funzioni:...

CVE-2021-26855

CVE-2021-26855 PoC della catena proxylogon SSRF CVE-2021-26855 per scrivere file di testanull, censurato da GitHub Perché GitHub rimuove questo exploit in quanto contrario alla politica di utilizzo accettabile, mentre tonnellate di altri exploit proof of concept e framework sono OK?...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 XSS SVG Riflesso Cross-Site Scripting Riflesso XSS tramite rendering SVG in FuguHub https://vulners.com/cve/CVE-2025-65790 Questo repository documenta una vulnerabilità di Cross-Site Scripting Riflesso XSS in FuguHub 8.1 , in cui i file SVG contenenti JavaScript inlin...

CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

CVE-2026-61792

Weblate , a web-based continuous localization platform, is affected by a path traversal vulnerability in its App store metadata download feature (versions prior to 2026.7 ). Attacker-influenced paths are resolved without adequate confinement to the repository, allowing a user with project-adminis...

CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

CVE-2026-77652

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

CVE-2026-75327

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2026-21440

CVE-2026-21440 PoC avanzato solo di rilevamento per CVE-2026-21440 che interessa AdonisJS BodyParser. Nessuno sfruttamento incluso. CVE-2026-21440 – PoC di rilevamento avanzato per AdonisJS Descrizione Questo progetto fornisce un Proof of Concept PoC avanzato solo di rilevamento per CVE-2026-2144...

Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

MAL-2026-14545 Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

CVE-2025-63298

CVE-2025-63298 È stata identificata una vulnerabilità di path traversal in SourceCodester Pet Grooming Management System 1.0, che interessa il componente admin/managewebsite.php. Un utente autenticato con privilegi amministrativi può sfruttare questa falla inviando una richiesta POST appositament...

CVE-2026-63179

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-36851

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-54256

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to rea...

CVE-2026-32639

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-63179

Winter CMS (a Laravel-based PHP content management system) versions up to and including 1.2.12 allow authenticated backend users to disclose arbitrary files readable by the PHP process. The root cause is that the LESS parser (via the wikimedia/less.php integration in Winter Storm) was instantiate...

CVE-2026-63179 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-63179 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...