CVE-2024-22939

objetivo:https://github.com/sunkaifei/FlyCms versión: v1.0 Se descubrió que FlyCms v1.0 contiene una Cross-Site Request Forgery CSRF a través del componente /system/article/categoryedit Poc history.pushState'', '', '/' Éxito:...

react2shell

React2Shell - PoC del Exploit CVE-2025-55182 Un exploit de prueba de concepto para CVE-2025-55182, una vulnerabilidad crítica de Ejecución Remota de Código en aplicaciones Next.js que utilizan React Server Components. ⚠️ AVISO LEGAL ESTA HERRAMIENTA ES SOLO PARA PRUEBAS DE SEGURIDAD EDUCATIVAS Y...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2022-1040

CVE-2022-1040 que el PoC te acompañe Encontrado por ahí curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'https://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json="🦞":"test"'...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Carga Arbitraria de Archivos No Autenticada Metasploit Fecha: 30-01-2021 Autor del Exploit: Berkan Er [email protected] Página del Proveedor: https://www.fortilogger.com/ Enlace del Software: https://www.fortilogger.com/download Versión: 4.4.2.2 Probado en:...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Alfresco Share - Open Redirect

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-14223 info: name:...

Mlflow - Cross-Site Scripting

The vulnerability allows an attacker to inject malicious code into the Content-Type header of a POST request, which is then reflected back to the user without proper sanitization or escaping. id: CVE-2023-6568 info: name: Mlflow - Cross-Site Scripting author: ritikchaddha severity: medium...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

CVE-2024-24919-Bulk-Scanner

Escáner Masivo CVE-2024-24919 CVE-2024-24919 Divulgación de Información de Check Point Security Gateway Script basado en y el crédito va para: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ Este script de Python escanea una lista de URLs en busca de la vulnerabilidad...

CVE-2026-37064

CVE-2026-37064 Enumeración de usuarios en /vfm-admin/ajax/usr-check.php en Veno File Manager Project 4.4.9 permite a un atacante no autenticado enumerar los usuarios de la aplicación mediante el envío de una solicitud POST especialmente diseñada al endpoint afectado con un parámetro 'username'...

CVE-2024-36401

RCE for CVE-2024-36401 POC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets. Overview POC for CVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer. This POC is based on the security advisory by phith0n. H...

netwave-dosvulnerability

Netwave IP Camera server vulnerable to unauthenticated Denial of Service via one single huge POST request on any firmware. CVE| Descripción ---|--- CVE-2018-6479| Vulnerabilidad de denegación de servicio remota no autenticada CVSS| Puntuación| Detalles ---|---|--- 3| 7.3|...

CVE-2025-5777

. PoC POST /p/u/doAuthentication.do HTTP/1.1 Host: 167.xxx.xx.x Content-Length: 5 login . La herramienta verifica y luego realiza 20 solicitudes más para explotar. . Uso:- python CVE‑2025‑5777.py python CVE‑2025‑5777.py -l test.txt...

EUVD-2026-91802

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

exploit-CVE-2020-24815

exploit-CVE-2020-24815.py este es mi primer exploit para CVE-2020-24815 pon la ruta POST después de la url !!!! Ejemplo: si el script no funciona cambia la cookie en el script $ - pip install -r requirements.txt arreglar problema pdftotext no instalado: $ - sudo apt-get install build-essential...

CVE-2023-25194

Esta herramienta está destinada únicamente a fines de pruebas de seguridad. No realice actividades ilegales. Cualquier consecuencia derivada del mal uso es responsabilidad exclusiva suya. La herramienta de detección CVE-2023-25194 utiliza JNDI para cargar el contenido de respuesta devuelto por la...