JNDI-Injection-Exploit-Plus

JNDI-Injection-Exploit-Plus README in cinese Descrizione JNDI-Injection-Exploit-Plus è uno strumento per generare link JNDI funzionanti e fornire servizi in background avviando server RMI, LDAP e HTTP. Usando questo strumento puoi ottenere link JNDI che puoi inserire nel tuo POC per testare la...

MAL-2026-14533 Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

CVE-2024-21534-poc

Vulnerability: CVE-2024-21534 Severity: Kritisch CVSS Score: 9.8 Description: Das Paket jsonpath-plus Versionen = 10.0.7 ist anfällig für eine Remote-Code-Ausführung RCE Schwachstelle, die es Angreifern ermöglicht, beliebigen Code über das VM-Modul von Node.js auszuführen. Diese Schwachstelle wir...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE-Schwachstelle 1. Schwachstellenbeschreibung ZOHO ManageEngine ADSelfService Plus ist eine integrierte Lösung des Unternehmens Zoho ZOHO für Self-Service-Passwortverwaltung und Single Sign-On in Active Directory- und Cloud-Umgebungen...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 Strumento di rilevamento della vulnerabilità RCE di ADSelfService Plus Fork Descrizione ZOHO ManageEngine ADSelfService Plus è una soluzione integrata di gestione delle password self-service e single sign-on per Active Directory e applicazioni cloud offerta d...

CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP - Enumerazione utenti di Active Directory CVE-2021-31159 Questo script sfrutta il fatto che ServiceDesk Plus, prima della build 10519, restituisce output diversi nella funzionalità di recupero password: se l'utente esiste, viene restituito un messaggio che...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-24358 info: name: Plus Addons for Elementor Page Builder 4.1.10 - Open Redirect...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

phpMyChat-Plus 1.98 - Cross-Site Scripting

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. id: CVE-2019-19908 info: name: phpMyChat-Plus 1.98 - Cross-Site Scripting author: madrobot severity: medium description: | phpMyChat-Plus 1.98 contains a cross-site...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

ionCube Tester Plus <= 1.3 - Local File Inclusion

The ionCube Tester Plus plugin for WordPress versions = 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without...

CVE-2022-35405

CVE-2022-35405 Il mio post sul blog Nuclei template Altro articolo PoC della vulnerabilità di esecuzione remota di codice senza autenticazione in ManageEngine PAM360 e Password Manager Pro Access Manager Plus solo se autenticato :...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Hijacking dell'account privilegiato Data: 30-03-2019 Autore dell'exploit: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Homepage del Vendor:www.manageengine.com Prodotto: Service Desk Plus Versione: 10.0 Testato su: Windows 10 64 bit CVE:...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: Vulnerabilità di bypass dell'autenticazione durante il login SAML in ServiceDesk Plus. Come descritto da ManageEngine. Se l'installazione di ServiceDesk Plus 11134 presa di mira ha il login SAML abilitato e disponi delle credenziali di un utente con...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 Vulnerabilità di elevazione dei privilegi Descrizione "Modify Computers" è un ruolo predefinito in ADManager per la gestione dei computer. Se un utente tecnico dispone del privilegio Modify Computers su un computer, può modificare gli attributi...