13118 matches found
GHSA-HFF8-HJWV-J9Q7 Remote Code Execution on click of <a> Link in markdown preview
Summary There is a vulnerability in Joplin-desktop that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML...
PT-2024-35159 · Craft · Craft
Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.12.2 and 5.4.3 Description: The issue is related to a missing normalizePath in the FileHelper::absolutePath function, which could lead to Remote Code Execution on the server via twig Server Side Template Injection...
Exploit for SQL Injection in Wordpress
CVE-2022-21661 CVE-2022-21661 docker and poc functions.php需要替...
Exploit for Code Injection in Wppa Wp_Photo_Album_Plus
WordPress WP Photo Album Plus Arbitrary Shortcode Execution...
Malicious code in akita-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551f04343832933628b5f36ec11b0f08219b6ad2c16bdc366b56ce2977b5f721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10542 Malicious code in akita-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551f04343832933628b5f36ec11b0f08219b6ad2c16bdc366b56ce2977b5f721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in poc-lelouch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5593904da4697f6d80bea8f6926ba9668d25c9ba34ba801115e347ffc19c719c The OpenSSF Package Analysis project identified 'poc-lelouch' @ 1.6.0 npm as malicious. It is considered malicious because: - The package execut...
MAL-2024-10568 Malicious code in poc-lelouch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5593904da4697f6d80bea8f6926ba9668d25c9ba34ba801115e347ffc19c719c The OpenSSF Package Analysis project identified 'poc-lelouch' @ 1.6.0 npm as malicious. It is considered malicious because: - The package execut...
Devtron has SQL Injection in CreateUser API
Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...
GHSA-Q78V-CV36-8FXJ Devtron has SQL Injection in CreateUser API
Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...
Exploit for Deserialization of Untrusted Data in Alibaba Fastjson
CVE-2022-25845-In-Spring 主要依赖 1. jackson 2. commons-io 快...
Exploit for OS Command Injection in Php
CVE-2024-4577 RCE Exploit While implementing PHP, the team d...
Exploit for Code Injection in Ejs
THM Challenge: SSTI RCE...
Sysax Multi Server 6.99 Cross Site Scripting
Exploit Title: Sysax Multi Server 6.99 - Reflected XSS Date: 2024-11-03 Exploit Author: Yehia Elghaly Mrvar0x Vendor Homepage: https://www.sysax.com/ Software Link: https://www.sysax.com/download/sysaxservsetup.msi Version: MultiServer 6.99 Tested on: Windows 10 x64 Reflected XSS - Affected...
Exploit for CVE-2024-51132
CVE-2024-51132-POC Vulnerability Type XXE - XML Externa...
Exploit for Untrusted Search Path in Yandex Yandex_Browser
CVE-2024-6473 PoC Yandex Browser for Desktop before 24.7...
Path traversal in oak allows transfer of hidden files within the served root directory
Summary By default oak does not allow transferring of hidden files with Context.send API. However, this can be bypassed by encoding / as its URL encoded form %2F. Details 1. Oak uses decodeComponent which seems to be unexpected. This is also the reason why it is not possible to access a file that...
Exploit for SQL Injection in Ultimatemember Ultimate_Member
CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof o...