CVE-2018-11776

CVE-2018-11776 Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications. Install and Exploiting https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Suricata In the file "test.rules " presents a rule for t...

Drupal-cve-2019-6340

Research CVE 2019-6340 root@kitploit: The site as Drupal 8 core RESTful API Services module gets enabled and allows the user to send GET, PATCH or POST Request to the server. GET request is enough to trigger the code execution vulnerability even though PATCH method is disabled The site has any...

CVE-2024-57241

CVE-2024-57241CNNVD-2024-34500830 For web applications using DEDECMS 5.71SP1 and earlier, URL redirects occur because the source code logic error of the CMS does not judge the input GET request For web applications using DEDECMS 5.71SP1 and below, URL redirection occurs because the CMS source cod...

CVE-2023-23752

CVE-2023-23752 Joomla CVE-2023-23752 スキャナ用のシンプルなプログラムです。これは、対象のリストが Web アプリケーションの重大なセキュリティ脆弱性である CVE-2023-23752 に対して脆弱かどうかをチェックするシンプルな Ruby スクリプトです。このスクリプトは指定されたエンドポイントに HTTP GET リクエストを送信し、レスポンスから情報を抽出して対象が脆弱かどうかを判定します。 使用方法 root@kitploit: ruby scanner.rb list.txt output.txt list.txt は、対象のドメインまたは...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

CVE-2019-20085

📂 CVE-2019-20085 – TVT NVMS-1000 ディレクトリトラバーサルエクスプロイト By Z3R0 作者: Z3R0 CVE: CVE-2019-20085 対象: TVT NVMS-1000（パッチ以前の全ての既知バージョン） 脆弱性の種類: 認証不要のディレクトリトラバーサル 日付: リリース日を挿入 🔍 脆弱性の概要...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Reprise License Manager 14.2 - Cross-Site Scripting

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. id: CVE-2021-45422 info: name: Reprise License Manager 14.2 - Cross-Site Scripting author: edoardottt severity: medium description: | Reprise License Manager 14.2...

CVE-2026-30498

CVE-2026-30498 – CSRF 漏洞（AdminPanel 4.0） 概述 CVE 编号： CVE-2026-30498 （由 MITRE 保留） 发现者： Mehdi Ben Hamou AdminPanel 4.0 的 delete.php 端点存在跨站请求伪造（CSRF）漏洞。 该漏洞允许攻击者在未经用户同意的情况下，以已认证用户的身份触发敏感操作（文件删除）。 技术细节 该漏洞是由于缺少 CSRF 防护机制所致： 无 CSRF 令牌验证 无 Origin / Referer 验证 敏感操作通过 GET 请求 暴露 未验证用户意图...

EUVD-2026-80815

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2020-14882

CVE-2020-14882 このスクリプトは、認証されていないGETリクエストを使用して、Oracle WebLogic Serverでリモートコード実行（RCE）を可能にします。これは脆弱性CVE-2020-14882を悪用します。任意のコマンドを実行することで、攻撃者はサーバーへの不正アクセスを取得できます。 エクスプロイトの詳細 エクスプロイトタイトル: Oracle WebLogic Server、GETリクエストによる認証なしRCE エクスプロイト作者: Danny Safaya CVE: CVE-2020-14882 ベンダーホームページ: Oracle WebLogic...

CVE-2026-27559

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80246

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561 Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561

CVE-2026-27561 is a command injection vulnerability in the /api/iodd/config endpoint. A high-privileged remote attacker can exploit it by sending a crafted GET request with admin credentials , enabling execution of commands with root privileges on the affected device. The CNA is CERT-VDE , which ...

EUVD-2026-80242

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2020-14882

CVE-2020-14882 CVE-2020–14882 - Jangによる調査 @s1kr10sによるコード Poc: 投稿レビュー / 動画: root@kitploit: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf https://www.youtube.com/watch?v=JFVDOIL0YtA&feature=youtu.be...

CVE-2026-52823

Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...