CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload Il existe plusieurs téléchargements de fichiers sans restriction qui aboutissent à l'exécution arbitraire de code PHP. Pages vulnérables authentifiées : localhost/officeadmin/?pid=54&action=add root@kitploit:...

MySQL-Fu.rb

MySQL-Fu.rb MySQL-Fu — это скрипт клиента MySQL на Ruby, который я написал. Он выполняет большинство функций обычного клиента MySQL: SQL Shell, обновление/удаление/удаление базы данных/таблицы, добавление/удаление пользователей, дамп базы данных/таблицы с опцией gzip...... Плюс несколько...

CVE-2020-24186

CVE-2020-24186 Ce script exploite la vulnérabilité CVE-2020-24186 dans WordPress pour télécharger une charge utile PHP camouflée et obtenir un shell sur le système cible. Il propose trois modes de fonctionnement : 1. Shell interactif : Télécharge le webshell de base et entre en mode interactif,...

Python-CVE-2020-25213

Python-CVE-2020-25213 Exploit interactif en Python pour la vulnérabilité WP File Manager. Le plugin File Manager wp-file-manager pour WordPress, avant la version 6.9, permet à des attaquants distants de téléverser et d'exécuter du code PHP arbitraire, car il renomme un fichier connecteur elFinder...

SEPM-EoP

Résumé Nom du produit : Symantec Endpoint Protection Manager Version 14 14 MP1 .2 build 1023 14.2.1023.0100 - les versions plus anciennes peuvent également être affectées Impact : Élevé. Un utilisateur Windows standard pas un administrateur peut escalader vers NT SERVICE\semwebsrv . Avec ce rôle...

CVE-2024-4577

CVE-2024-4577 Уязвимость внедрения аргументов в PHP УСТАНОВКА git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt ИСПОЛЬЗОВАНИЕ root@kitploit: Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets...

CVE-2026-27555

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27557 Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80238

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555

CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...

CVE-2026-27554 Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80230

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

tirreno

tirreno tirreno est une solution open source d'analyse de sécurité. tirreno tir.ˈrɛ.no aide à comprendre, surveiller et protéger vos applications contre les cybermenaces, les prises de contrôle de comptes, les bots et les abus. Alors que la cybersécurité classique se concentre sur l'infrastructur...

CVE-2026-29861

CVE-2026-29861 🛡️ Divulgation CVE : CVE-2026-29861 — Injection SQL dans PHP-MYSQL-User-Login-System Date de divulgation : 10 avril 2026 Identifiant CVE : CVE-2026-29861 Gravité : CRITIQUE CVSS 9.8 🧩 Résumé Une vulnérabilité critique d'injection SQL existe dans PHP-MYSQL-User-Login-System v1.0, plu...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76551

WP Import Export Lite WordPress plugin versions prior to 3.9.33 are vulnerable to authenticated remote code execution (RCE) . The plugin fails to restrict which PHP function can be applied to exported field values, so any user with the plugin's export permission can invoke arbitrary PHP functions...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...