CVE-2022-41082-POC

CVE-2022-41082-POC PoC для уязвимости CVE-2022-41082 NotProxyShell OWASSRF, затрагивающей серверы Microsoft Exchange Это Post-Auth RCE для ProxyNotShell OWASSRF, для выполнения команд требуются действительные учётные данные. Добавлен Powershell PoC-скрипт для уязвимости TabShell CVE-2022-41076...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 RCE после аутентификации суперадминистратор Описание уязвимости Crater Invoice уязвим к неограниченной загрузке файлов опасного типа из-за отсутствия надлежащей проверки ввода. Класс проверки Base64Mime можно обойти, встроив действительную...

CVE-2019-20224

CVE-2019-20224 Официальный эксплойт для Pandora v7.0NG Post-auth Remote Code Execution CVE-2019-20224...

CVE-2020-8813

CVE-2020-8813 Официальный эксплойт для Cacti v1.2.8 удаленное выполнение кода CVE-2020-8813 Cacti v1.2.8 Удаленное выполнение кода до аутентификации Cacti v1.2.8 Удаленное выполнение кода после аутентификации...

CVE-2023-20209

Я начал изучать Cisco Expressway после того, как заметил довольно много таких устройств в интернете во время Red Team-заданий, но у меня не было времени в рабочее время, чтобы исследовать продукт дальше. Изначально я искал обход аутентификации, чтобы сцепить его с RCE, но время вышло, и я...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC PoC для уязвимости CVE-2022-41082 NotProxyShell OWASSRF, затрагивающей Microsoft Exchange Servers Это Post-Auth RCE для ProxyNotShell OWASSRF, требуются действительные учетные данные для выполнения команд. Добавлен PoC-скрипт PowerShell для уязвимости TabShell CVE-2022-41076...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift Детали уязвимости Уязвимость, как показано в HackTheBox - SwagShop Этап 1 = exploit.py Получить учетные данные администратора для панели управления Magento CMS Этап 2 = postauth.py С учетными данными, полученными из exploit.py, добавленными в postauth.py, выполните:...

CVE-2019-11539

CVE-2019-11539 Первоначальное обнаружение: Orange Tsai, Meh Chang Авторы: Justin Wagner, Alyssa Herrera Благодарности: Orange, Meh Chang, Rich Warren, Alyssa, Mimir Описание уязвимости В Pulse Secure Pulse Connect Secure версии 9.0RX до 9.0R3.4, 8.3RX до 8.3R7.1, 8.2RX до 8.2R12.1 и 8.1RX до...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

DEBIAN-CVE-2026-23943

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

VulnCheck KEV: CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2025-49218

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute...

Fedora 42 : roundcubemail (2025-70701de9de)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory. This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix Post-Auth RCE...