CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Configuración del laboratorio docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000 Descripción Las version...

Sandboxie

Sandboxie Plus / Classic EN | 中文 System requirements| Release notes| Contribution guidelines| Security policy| Code of Conduct ---|---|---|---|--- Windows 7 or higher 64-bit| CHANGELOG.md| CONTRIBUTING.md| SECURITY.md| CODEOFCONDUCT.md Sandboxie is a sandbox-based isolation software for Windows...

CVE-2021-44077

CVE-2021-44077 CVE-2021-44077 的概念验证利用程序：ManageEngine ServiceDesk Plus msiexec.exe pip install 安装 requirements 文件，或确保已安装 requests 包。 如果你要接收反弹 shell，请先运行你的监听器，例如： nc -l 4444 然后运行利用脚本，传入 url 和 exe 参数，例如： python exploit.py http://: 示例脚本输出： % python exploit.py http://192.168.0.140:8080 msiexec.exe +...

CVE-2022-28219

CVE-2022-28219 POC para CVE-2022-28219 que afecta a versiones de ManageEngine ADAudit Plus anteriores a la 7060 Análisis Técnico Más detalles en nuestro blog: https://www.horizon3.ai/red-team-blog-cve-2022-28219 Uso % python3 CVE-2022-28219.py -h usage: CVE-2022-28219.py -h -t TARGET -l LHOST -d...

JNDI-Injection-Exploit-Plus

JNDI-Injection-Exploit-Plus English README JNDI-Injection-Exploit-Plus改写自welk1n大佬的JNDI-Injection-Exploit项目。 详细说明 是一款JNDI注入利用工具，可以生成JNDI链接并启动后端相关服务。 根据JNDI的三种触发点，提供3种JNDI利用方式 远程Reference链 （3种） 本地Reference链 （4种） 反序列化链（75种） P.S. 具体利用链名称及依赖见 表格 使用方法 $ java -jar...

JSONPath

véase también licencias para dependencias de desarrollo JSONPath Plus Analiza, transforma y extrae selectivamente datos de documentos JSON y objetos JavaScript. jsonpath-plus amplía la especificación original para añadir algunos operadores adicionales y hace explícitos algunos comportamientos que...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Secuestro de cuenta privilegiada Fecha: 30-03-2019 Autor del exploit: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Página del vendor:www.manageengine.com Producto: Service Desk Plus Versión: 10.0 Probado en: Windows 10 64 bits CVE : 2019-100...

Agatsa-EasyTouch-Plus---CVE-2025-56019

本报告涉及CVE-2025-56019，该漏洞为easytouch+产品BLE认证预留，由发现者Yashodhan Vivek Mandke分配。请下载本仓库中的报告PDF。...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnerable a la Ejecución Remota de Código RCE debido a una sanitización inadecuada de la entrada Resumen CVE-2024-21534 es una vulnerabilidad crítica encontrada en versiones del paquete jsonpath-plus anteriores a la versión 10.0.0. La vulnerabilidad se debe a u...

miLazyCracker

miLazyCracker Implementación de ataque Hardnested para tarjetas Mifare Classic Plus para lectores USB LibNFC SCL3711, ASK LoGO, etc. Instalación: ./miLazyCrackerFreshInstall.sh Ejemplo de uso: coloca una tarjeta y disfruta mkdir mydumps cd mydumps miLazyCracker Posible problema: error...

CVE-2019-12189

CVE-2019-12189 - Vulnerabilidad XSS en Zoho ManageEngine ServiceDesk Plus 9.3 Información Descripción: Se descubrió XSS en ManageEngine ServiceDesk Plus versión Versiones afectadas: 9.3 Investigador: Dang The Tuyen Prueba de concepto La vulnerabilidad se origina por la confusión de comillas simpl...

CVE-2022-47966

CVE-2022-47966 POC para CVE-2022-47966 que afecta los siguientes productos de ManageEngine: Access Manager Plus Active Directory 360 ADAudit Plus ADManager Plus ADSelfService Plus Analytics Plus Application Control Plus Asset Explorer Browser Security Plus Device Control Plus Endpoint Central...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

phpMyChat-Plus 1.98 - Cross-Site Scripting

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. id: CVE-2019-19908 info: name: phpMyChat-Plus 1.98 - Cross-Site Scripting author: madrobot severity: medium description: | phpMyChat-Plus 1.98 contains a cross-site...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-24358 info: name: Plus Addons for Elementor Page Builder 4.1.10 - Open Redirect...

ionCube Tester Plus <= 1.3 - Local File Inclusion

The ionCube Tester Plus plugin for WordPress versions = 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539：ADSelfService Plus RCE漏洞 一：漏洞描述 ZOHO ManageEngine ADSelfService Plus是卓豪（ZOHO）公司的针对 Active Directory 和云应用程序的集成式自助密码管理和单点登录解决方案。 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus 6113 及更早版本存在 REST API 身份验证绕过漏洞，远程攻击者可以利用此漏洞来控制受影响的系统。该漏洞CVSS评分：9.33，危害等级：严重 二：漏洞利用...