13236 matches found
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169-CACTI-1.2.22 This is a exploit of CVE-2022-4616...
Sharepoint Dynamic Proxy Generator Unauth RCE
This module exploits two vulnerabilities in Sharepoint 2019, an auth bypass CVE-2023-29357 which was patched in June of 2023 and CVE-2023-24955, an RCE which was patched in May of 2023. The auth bypass allows attackers to impersonate the Sharepoint Admin user. This vulnerability stems from the...
CVE-2023-30854
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4...
DedeCMS <= 5.7.107 Multiple Vulnerabilities
DedeCMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dedecms:dedecms"; if description...
Offchain resolver can be subject to man in the middle attacks
Lines of code Vulnerability details Description Calls to the offchain resolver are produced by the code below: function resolve bytes calldata name, bytes calldata data external view returns bytes memory string memory urls = new string; urls0 = gatewayURL; revert OffchainLookup addressthis, urls,...
Remote code execution in JFinal CMS
JFinal CMS v5.1.0 was discovered to contain a remote code execution RCE vulnerability via the ActionEnter function...
RCE in developer mode
Description Nuxt contains a test-component-wrapper component. This is used to mount a single component for testing. This component has a dynamic import function which accepts arbitrary user input on the server side. This pattern will almost always lead to an RCE bug. Requirements & Notes The serv...
CVE-2023-30349
CVE-2023-30349 affects JFinal CMS v5.1.0; confirmed remote code execution via the ActionEnter function. The vulnerability is described as a high-severity (CVSS v3.1: 9.8) network‑based issue with no authentication required and no user interaction. The provided documents do not specify a fixed ver...
Huawei EulerOS: Security Advisory for sysstat (EulerOS-SA-2023-1631)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Remote code execution
Aigital Wireless-N Repeater MiniRouter v0.131229 was discovered to contain a remote code execution RCE vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request...
Exploit for Injection in Strapi
CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting E...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Apache Shardingsphere_Elasticjob-Ui
CVE-2022-22733 CVE-2022-22733 is a vulnerabilit that affects...
Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Exploit
Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution RCE Date: 4/23/2023 Author: Or4nG.M4n Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CVE-2023-30404
Aigital Wireless-N Repeater MiniRouter v0.131229 was discovered to contain a remote code execution RCE vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request...
CVE-2023-30404
CVE-2023-30404 affects Aigital Wireless-N Repeater Mini_Router v0.131229. The issue is a remote code execution (RCE) in the formSysCmd function, exploitable via the sysCmd parameter and a crafted HTTP request. Connected sources confirm the vulnerable component is the formSysCmd/sysCmd pathway, wi...
Reddit: Blind SSRF to internal services in matrix preview_link API
A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...
Exploit for Command Injection in Sophos Web_Appliance
Dork fofa title="Sophos Web Appliance" || app="Sophos-W...
CVE-2023-27848
CVE-2023-27848 affects broccoli-compass v0.2.4. A remote code execution (RCE) vulnerability exists via the child_process function, allowing execution of attacker-controlled code. Impact is high (C/H/I/H/A/H) per the CVSS3.1 data; exploitation is network-borne with no user interaction and no privi...
CVE-2023-27849
CVE-2023-27849 affects rails-routes-to-json v1.0.0 and is described as a remote code execution (RCE) vulnerability triggered via the child_process function. Public entries consistently indicate network-based exploitation with high impact to confidentiality, integrity, and availability. No specifi...