Python-CVE-2020-25213

Python-CVE-2020-25213 Exploit interactif en Python pour la vulnérabilité WP File Manager. Le plugin File Manager wp-file-manager pour WordPress, avant la version 6.9, permet à des attaquants distants de téléverser et d'exécuter du code PHP arbitraire, car il renomme un fichier connecteur elFinder...

SEPM-EoP

Résumé Nom du produit : Symantec Endpoint Protection Manager Version 14 14 MP1 .2 build 1023 14.2.1023.0100 - les versions plus anciennes peuvent également être affectées Impact : Élevé. Un utilisateur Windows standard pas un administrateur peut escalader vers NT SERVICE\semwebsrv . Avec ce rôle...

CVE-2024-4577

CVE-2024-4577 Уязвимость внедрения аргументов в PHP УСТАНОВКА git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt ИСПОЛЬЗОВАНИЕ root@kitploit: Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets...

CVE-2026-27555

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27557 Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80238

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555

CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...

CVE-2026-27554 Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80230

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

CVE-2026-29861

CVE-2026-29861 🛡️ Divulgation CVE : CVE-2026-29861 — Injection SQL dans PHP-MYSQL-User-Login-System Date de divulgation : 10 avril 2026 Identifiant CVE : CVE-2026-29861 Gravité : CRITIQUE CVSS 9.8 🧩 Résumé Une vulnérabilité critique d'injection SQL existe dans PHP-MYSQL-User-Login-System v1.0, plu...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76551

WP Import Export Lite WordPress plugin versions prior to 3.9.33 are vulnerable to authenticated remote code execution (RCE) . The plugin fails to restrict which PHP function can be applied to exported field values, so any user with the plugin's export permission can invoke arbitrary PHP functions...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2023-36845

CVE-2023-36845 Vérification massive en une ligne CVE-2023-36845 cat ip.txt| while read host do;do curl -sk "http://$host/?PHPRC=/dev/fd/0" -X POST -d 'autoprependfile="/etc/passwd"'| grep -i 'root:' && echo $host "is VULNERABLE";done...

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...

CVE-2024-4577

CVE-2024-4577 Une preuve de concept développée par @watchTowr exploitant la vulnérabilité d'injection d'arguments PHP CGI CVE-2024-4577 pour obtenir une RCE sur une version vulnérable de PHP exécutée dans un environnement Windows. Analyse technique détaillée de cette vulnérabilité Orange Tsi 🍊...