Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'aid' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

F-logic DataCube3 - SQL Injection

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the reqid parameter. id: CVE-2024-31750 info: name: F-logic DataCube3 - SQL Injection author: DhiyaneshDK severity: high description: | SQL injection vulnerability in f-logic...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

Dify v1.6.0 - Server-Side Request Forgery

Dify v1.6.0 contains a server side request forgery caused by improper validation in controllers.console.remotefiles.RemoteFileUploadApi, letting attackers make arbitrary requests from the server, exploit requires network access. id: CVE-2025-56520 info: name: Dify v1.6.0 - Server-Side Request...

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. id: CVE-2022-37122...

Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request

An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. id: CVE-2025-32813 info: name: Infoblox NetMRI 7.6.1 - Unauthenticated Command Injection in getsamlrequest author: iamnoooob,pdresearch severity: high description: | An issue was discovere...

Kerio Control v9.2.5 - CRLF Injection

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5 id: CVE-2024-52875 info: name: Kerio Control v9.2.5 - CRLF Injection author: ritikchaddha,iamnoooob,rootxharsh,pdresearch...

DevDojo Voyager <=1.8.0 - Arbitrary File Read

DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. id: CVE-2024-55415 info: name: DevDojo Voyager =1.8.0 - Arbitrary File Read author: iamnoooob,rootxharsh,pdresearch severity: high description: | DevDojo Voyager through 1.8.0 is vulnerable to path traversal at t...

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

CVE-2017-18345-COM_JOOMANAGER-ARBITRARY-FILE-DOWNLOAD

COMJOOMANAGER 2.0 -任意文件下载 使用插件：COMJOOMANAGER，从 CMS：Joomla 批量收集数据库，项目使用 python 2.x 开发，更多信息，请访问 YouTube 视频。 CVE: 2017-18345 风险 : Security Risk High 0day.Today-ID: 29950 ExploitDB-id: 44252 0day db-id: 16348...

Flowise-CVE-2026-58057-exploit

Flowise CVE-2026-58057 - Эксплойт удаленного выполнения кода на Windows -orange?style=for...

CVE-2022-22718

Windows Print Spooler 中的权限提升漏洞 2022年2月9日：美国网络安全与基础设施安全局（CISA）将 Windows Print Spooler 漏洞添加到其积极利用漏洞列表中。该漏洞被标识为 CVE-2022–22718，通用漏洞评分系统（CVSS）评分为 7.2，属高危。该 CVE ID 与 CVE-2022-21997、CVE-2022-21999 和 CVE-2022-22717 相比有显著差异。...

proxmark3

proxmark3: das offizielle Proxmark-Repository! ⚠️ Dieses Repository wurde archiviert. Es wird nicht mehr gepflegt. Die aktive Entwicklung ist zu RRG Proxmark3 - Iceman Fork umgezogen. Der proxmark3 ist ein leistungsfähiges Allzweck-RFID-Werkzeug in der Größe eines Kartenspiels, das entwickelt...

CVE-2018-14667

CVE-2018-14667 Потратив много времени на понимание и корректную эксплуатацию этой уязвимости CVE, я решил создать репозиторий с ошибкой RCE в RichFaces 3.X и поделиться пошаговым руководством с сообществом. 0x00 : Введение в ошибку RichFaces 3.X В понедельник, 19 ноября, Жоау Ф.М. Фигейреду...

seeker

Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...

massdns

MassDNS 高性能DNSスタブリゾルバ MassDNSは、数百万から数十億単位の膨大な数のドメイン名を解決することを目的とした、シンプルで高性能なDNSスタブリゾルバです。特別な設定をしなくても、公開されているリゾルバを使用して、毎秒35万以上の名前を解決できます。 貢献者 Quirin Scheitle、ミュンヘン工科大学 コンパイル Gitリポジトリをクローンし、プロジェクトルートフォルダにcdしてください。そしてmakeを実行してソースからビルドします。Linux以外の場合はmake...

LetsDefend-CVE-2022-41082-Exploitation-Attempt

LetsDefend-CVE-2022-41082-Exploitation-Attempt 🛡️ 사고 보고: CVE-2022-41082 악용 시도 📅 날짜: 2022년 9월 30일 🕒 시간: 오전 07:19 🚨 심각도: 높음 🆔 사고 ID: 125 📊 세부 정보 핵심 속성| 값 ---|--- 이벤트 ID| 125 이벤트 시간| 2022년 9월 30일, 오전 07:19 규칙| SOC175 - 요청된 URL에서 PowerShell 발견 레벨| 보안 분석가 호스트 이름| Exchange Server 2 대상 IP 주소| 172.16.20.8...