117 matches found
CVE-2019-12725-Command-Injection
POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 Injection de commande à distance Zeroshell 3.9.0 est vulnérable à une exécution de commande à distance. Plus précisément, ce problème survient parce que l'application web gère mal certains paramètres HTTP. Un attaquant non authentifié pe...
BurpSentinel
Burp Sentinel Facilite la découverte des failles de sécurité courantes dans les applications web. Introduction / tutoriel: https://github.com/dobin/BurpSentinel/wiki/BurpSentinel---HowTo-and-introduction Blog: http://dobin.github.io/ Avec BurpSentinel, le testeur d'intrusion peut rapidement et...
CVE-2022-23642
PoC pour Sourcegraph Gitserver 3.37.0 RCE CVE-2022-23642 Sourcegraph avant la version 3.37.0 présente une vulnérabilité d'exécution de code à distance sur son service gitserver. Cela est dû à un manque de restriction sur l'exécution de la configuration git, de sorte que "core.sshCommand" peut êtr...
Arjun
Arjun Suite de découverte de paramètres HTTP Qu'est-ce qu'Arjun ? Arjun peut trouver des paramètres de requête pour des points de terminaison d'URL. Si vous ne comprenez pas ce que cela signifie, pas de problème, lisez la suite. Les applications web utilisent des paramètres ou requêtes pour...
CVE-2026-69093
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...
CVE-2026-58477
SIP (Sustainable Irrigation Platform) up to version 5.2.16 contains a mass assignment flaw where the value-setting interface copies every HTTP parameter into internal settings without whitelisting. This enables unauthenticated attackers to overwrite sensitive configuration such as the passphrase ...
Linux Distros Unpatched Vulnerability : CVE-2026-53448
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQ...
EUVD-2026-40281
A flaw has been found in foreman when HTTP parameters are modified in httpproxiescontroller and httpproxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component...
CVE-2026-13316
A flaw has been found in foreman when HTTP parameters are modified in httpproxiescontroller and httpproxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component...
CVE-2026-54419
PIAF-HMS (PBX-In-A-Flash Hotel Management System) contains multiple unauthenticated SQL injection vulnerabilities. The app has no authentication and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping, or param...
GHSA-F3RG-XQJJ-CJ9W n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Summary In affected versions of n8n-mcp, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters before sending workflow data to the project's anonymous telemetry backend. Values placed in HTTP-Request-style node parameters — such as customer or tenant...
CVE-2026-22209
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like alert1...
CVE-2019-12741
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...
CVE-2019-12725
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters...
CVE-2025-65202: Improper Neutralization of Special Elements used in an OS Command
TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "nextfile," which allows an attacker to execute arbitrary commands with root privileges...
EUVD-2020-29701
Malware in sbrugna...
EUVD-2004-1553
Malware in sbrugna...
EUVD-2017-12975
Malware in sbrugna...