CVE-2019-10475

CVE-2019-10475 POC rapide pour Jenkins CVE-2019-10475 / SECURITY-1490 signalé le 2019-10-23. Le problème se trouve dans le plugin build-metrics qui génère quelques métriques de build de base. Il est couramment utilisé avec le plugin Jenkins sidebar links. Il s'agit d'une vulnérabilité XSS reflété...

CVE-2022-23305_POC

CVE-2022-23305 Log4j JDBCAppender SQL 인젝션 POC 이것은 CVE-2022-23305 취약점을 시연하는 매우 간단한 Spring Boot 기반 애플리케이션입니다. Apache Maven, Spring Boot, Spring MVC 및 H2 인메모리 데이터베이스를 사용하여 URL 쿼리 문자열 매개변수로 전달된 하나의 간단한 항목을 기록합니다. Log4J가 JDBCAppender를 사용하도록 구성되어 있기 때문에 SQL 인젝션에 취약합니다. 로깅 구문은...

CVE-2025-30208

Инструмент обнаружения CVE-2025-30208 Анализ уязвимости Анализ и воспроизведение уязвимости произвольного чтения файлов Vite CVE-2025-30208 Введение Данный инструмент предназначен для проверки наличия уязвимости CVE-2025-30208 в целевой системе. Эта уязвимость позволяет злоумышленнику читать...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-Injection-SQL L'application OpenSource ERP présente une vulnérabilité d'injection SQL. CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - Obtenir le nom de la base de données POST /db/utils/query/data.xml HTTP/1.1 User-Agent:...

CVE-2026-97652

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-97652

The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-91337

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Отравление HTTP-кэша через неключевой параметр запроса Обзор Веб-кэш использует только путь URL в качестве ключа кэша, игнорируя параметры запроса. Злоумышленник может добавить вредоносную полезную нагрузку к неключевому параметру например, utmcampaign и отравить кэш. Последующие...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-101322

Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924 are vulnerable to an authorization header leakage due to a shared request handler that attaches the Authorization header to outgoing requests without verifying the destination origin. An attacker can trick a user into c...

CVE-2026-65694-PoC

CVE-2026-65694 — Microweber CMS : Lecture arbitraire de fichiers sans authentification Preuve de concept pour CVE-2026-65694 , une traversée de chemin sans authentification → lecture arbitraire de fichiers dans Microweber CMS. Un attaquant non authentifié peut lire tout fichier accessible à...

CVE-2024-50340

CVE-2024-50340 POC 요구 사항 registerargcargv 옵션이 PHP 구성 파일php.ini에서 활성화되어 있어야 합니다. 이 설정은 명령줄 인수와 쿼리 매개변수를 $SERVER'argv'에 로드합니다. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv 취약 코드 설명 이 Symfony 코드는 입력 인수ArgvInput를 사용하여 특정 환경 변수, 특히 APPENV와 APPDEBUG의 값을 결정합니다. Symfony 코드의 관련 부분은 다음과...

CVE-2025-30208-Vite

CVE-2025-30208 | Script Vite Cet outil est utilisé pour détecter si le système cible présente la vulnérabilité CVE-2025-30208. Cette vulnérabilité permet à un attaquant de lire des fichiers sensibles sur le serveur via un chemin spécifique par exemple /etc/passwd ou C:\windows\win.ini. L'outil...

VulnCheck KEV: CVE-2020-22209

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajaxcommon.php...

CVE-2025-49132

CVE-2025-49132 Preuve de Concept PoC Ce dépôt contient une Preuve de Concept PoC pour CVE-2025-49132, une vulnérabilité critique d'exécution de code à distance RCE non authentifiée dans les versions du Pterodactyl Panel antérieures à 1.11.11. Détails de la vulnérabilité Identifiant CVE :...

BIT-ENVOY-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Caméra IP / DVR / NVR Hikvision Authentification incorrecte — Élévation de privilège via un paramètre de requête spécialement conçu | ---|--- Identifiant CVE| CVE-2017-7921 Classe de vulnérabilité| CWE-287 : Authentification incorrecte Score de base CVSS v3.0| 10,0 Critique —...

PT-2026-102725

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext authz filter assumes that a request contains a :path pseudoheader when applying query parameters to set or query parameters to remove from an...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 permet une injection SQL Description suggérée : "ISIDA RETRIEVER v5.2" Injection SQL Fonctionnalité vulnérable : La plateforme ISIDA RETRIEVER est vulnérable à l'injection SQL URL et paramètre vulnérables : website.com/index.php?title=Injection URL et...