SSI-CVE-2022-21661

SSI-CVE-2022-21661 Informationssystemsicherheit – 2. Aufgabenstellung Untersuchung und Ausnutzung der Schwachstelle CVE-2022-21661, die SQL-Injection durch Plugin-POST-Anfragen in WordPress-Versionen unter 5.8.3 ermöglicht. Einrichtung der Umgebung Zum Starten und Konfigurieren der Umgebung führe...

netwave-dosvulnerability

Servidor Netwave IP Camera vulnerável a Negação de Serviço não autenticada por meio de uma única requisição POST gigante em qualquer firmware. CVE| Descrição ---|--- CVE-2018-6479| Vulnerabilidade de Negação de Serviço remota não autenticada CVSS| Pontuação| Detalhes ---|---|--- 3| 7.3|...

CVE-2025-57310

CVE-2025-57310 Uma vulnerabilidade de Cross-Site Request Forgery CSRF no Salmen2/Simple-Faucet-Script v1.07 através de uma requisição POST manipulada para admin.php?p=ads&c=1 permitindo que atacantes executem código arbitrário. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Pontuação Base...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: root@kitploit: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use...

CVE-2024-25180

CVE-2024-25180 Visão Geral pdfmake é uma impressão PDF puramente JavaScript do lado do cliente/servidor. As versões afetadas deste pacote são vulneráveis a injeção de código arbitrário. Um atacante pode executar código arbitrário enviando uma requisição POST cuidadosamente elaborada para o caminh...

exploit-CVE-2020-24815

exploit-CVE-2020-24815.py este é meu primeiro exploit para CVE-2020-24815 coloque o caminho do POST após a url !!!! Exemplo: se o script não funcionar, altere o cookie no script root@kitploit: $ - pip install -r requirements.txt corrigir problema pdftotext não instalado: root@kitploit: $ - sudo...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Nicht authentifizierter Denial-of-Service in ZTE-Routern, der weltweit 140.000+ Geräte betrifft 17+ Modelle Technische Aufschlüsselung von CVE-2026-34473, veröffentlicht aus dem ursprünglichen Offenlegungsset und den Firmware-Analyse-Artefakten. Live-Website:...

Spring4Shell-Python-Firewall-POC

Python Firewall zur Abschwächung von Spring4Shell CVE-2022-22965 1. Überblick Dieses Projekt ist eine einfache, aber effektive Firewall, die als Proof-of-Concept POC in Python implementiert wurde. Sie ist als HTTP-Server konzipiert, der eingehende POST-Anfragen inspiziert, um das spezifische...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Upload de Arquivo Arbitrário Não Autenticado Metasploit Data: 30-01-2021 Autor do Exploit: Berkan Er [email protected] Página do Fornecedor: https://www.fortilogger.com/ Link do Software: https://www.fortilogger.com/download Versão: 4.4.2.2 Testado em: Windows 1...

CVE-2026-77140

TYPO3 extension Telephone Directory (telephonedirectory) suffers from a Broken Access Control flaw. The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, but not in the action that persists the change. As a result, an unauthenticated visi...

CVE-2024-24919-Bulk-Scanner

CVE-2024-24919 Bulk Scanner CVE-2024-24919 Check Point Security Gateway Informationspreisgabe Skript basiert auf, und die Anerkennung geht an: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ Dieses Python-Skript durchsucht eine Liste von URLs auf die...

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Alfresco Share - Open Redirect

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-14223 info: name:...

Mlflow - Cross-Site Scripting

The vulnerability allows an attacker to inject malicious code into the Content-Type header of a POST request, which is then reflected back to the user without proper sanitization or escaping. id: CVE-2023-6568 info: name: Mlflow - Cross-Site Scripting author: ritikchaddha severity: medium...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POST-Request-Bypass Imperva Cloud WAF war anfällig für einen Bypass, der es Angreifern ermöglicht, WAF-Regeln zu umgehen, wenn sie bösartige HTTP-POST-Payloads senden, wie z. B. log4j-Exploits, SQL-Injection, Befehlsausführung, Directory Traversal, XXE usw...