9 matches found
HTB-Pterodactyl-RCE-CVE-2025-49132
Pterodactyl Panel Locale RCE CVE-2025-49132 — शैक्षिक PoC -6f42c1 केवल अधिकृत परीक्षण और रक्षात्मक सीखने के लिए। यह रिपॉजिटरी नियंत्रित प्रयोगशाला वातावरण जैसे, CTF/HTB-शैली सेटअप के लिए है, जहां आप लक्ष्य के मालिक हैं या उसका परीक्षण करने की स्पष्ट लिखित अनुमति है। संदर्भ इस रिपॉजिटरी में एक...
CVE-2025-49132_HTB_SEASON10
CVE-2025-49132 - Pterodactyl Panel RCE 漏洞利用 HTB 第十季 - Pterodactyl 机器 Writeup 概述 目标： Pterodactyl HTB 机器（中等难度） CVE： CVE-2025-49132 严重性： 严重（CVSS 9.8） 攻击类型： 未认证远程代码执行 影响范围： Pterodactyl Panel 远程代码执行 方法 1：使用提供的 exploit.sh root@kitploit: chmod +x exploit.sh 获取用户 flag ./exploit.sh flag 执行命令 ./exploit.sh...
CVE-2025-49132
CVE-2025-49132 برهان المفهوم PoC يحتوي هذا المستودع على برهان المفهوم PoC للثغرة CVE-2025-49132، وهي ثغرة حرجة في تنفيذ الأوامر عن بُعد دون مصادقة RCE في لوحة Pterodactyl Panel للإصدارات السابقة لـ 1.11.11. تفاصيل الثغرة معرف CVE : CVE-2025-49132 الخطورة : 10.0 حرجة -...
CVE-2026-40909
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint locale/save.php constructs a file path by directly concatenating $POST'flag' into the path at line 30 without any sanitization. The $POST'code' parameter is then written verbatim to that path via...
CVE-2026-33513
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint APIName=locale concatenates user input into an include path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be...
CVE-2026-33513 AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint APIName=locale concatenates user input into an include path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the block/locale endpoint due to improper sanitization of the locale parameter. PoC html https://redacted.de/cookiebar/block/dens82w%22%3E%3Cimg%20src%3da%20onerror%3dalert1%3Ew9qt...
PT-2024-32386 · Contao +1 · Contao Open Source Cms +1
Name of the Vulnerable Software and Affected Versions: Oveleon Cookie Bar versions prior to 1.16.3 and 2.1.3 Description: The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend's HTTP response, thereby causing reflected cross-site...