35661 matches found
Socomec DIRIS A-40 Devices Password Disclosure
Socomec DIRIS A-40 devices before 48250501 are susceptible to a password disclosure vulnerability in the web interface that could allow remote attackers to get full access to a device via the /password.jsn URI. id: CVE-2019-15859 info: name: Socomec DIRIS A-40 Devices Password Disclosure author:...
Intel Neural Compressor <2.5.0 - SQL Injection
Improper input validation in some IntelR Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access. id: CVE-2024-22476 info: name: Intel Neural Compressor 2.5.0 - SQL Injection author: ritikchaddha,daffainfo...
Jinher OA - SQL Injection
jinher jinheroa is an office automation software that facilitates workflow management and collaboration within organizations. It sits in the enterprise layer of the tech stack, is typically deployed as selfhosted, and—within the informationtechnology industry—serves the businessapps domain. id:...
PraisonAI - Authentication Bypass
PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. id: CVE-2026-44338 info: name: PraisonAI -...
Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass
IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...
Onkyo TX-NR585 Web Interface - Directory Traversal
Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal and local file inclusion. id: CVE-2020-12447 info: name: Onkyo TX-NR585 Web Interface - Directory Traversal author: 0xAkoko severity: high...
WAVLINK AC1200 - Information Disclosure
A vulnerability is in the 'livemfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router. id: CVE-2021-44260 info: name:...
HP Switch - Authentication Bypass
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...
ComfyUI-Manager < 3.38 - Configuration Overwrite
ComfyUI-Manager 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access. id: CVE-2025-67303 info: name:...
Casdoor - Authorization Bypass
Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...
Teleport - Authentication Bypass
Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems. id: CVE-2025-49825 info: name: Teleport - Authentication Bypass author: pdteam severity: critical description: | Teleport...
Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotel...
AsyncRAT-C-Sharp
AsyncRAT AsyncRAT 是一款远程访问工具（RAT），旨在通过安全的加密连接远程监控和控制其他计算机 包含的项目 本项目包含以下内容 用于发送和接收命令的插件系统 用于控制客户端的访问终端 可通过终端管理的可配置客户端 记录所有重要事件的日志服务器 功能包括： 客户端屏幕查看与录制 客户端杀毒与完整性管理器 客户端SFTP访问（包括上传和下载） 客户端与服务器聊天窗口 客户端动态DNS与多服务器支持（可配置） 客户端密码恢复 客户端JIT编译器 客户端键盘记录 客户端反分析（可配置） 服务器控制的更新 客户端反恶意软件启动 服务器配置编辑器 服务器多端口接收器（可配置）...
beyondtrust-rce-scanner
CVE-2026-1731 — BeyondTrust Remote Support & PRA 预认证 RCE 概述 BeyondTrust Remote Support 和 Privileged Remote Access 中存在严重的预认证 RCE 漏洞。未经身份验证的远程攻击者可以执行操作系统命令。 字段| 值 ---|--- CVE| CVE-2026-1731 严重级别| CRITICAL 产品| BeyondTrust Remote Support & PRA CISA KEV| 2026-02-06 攻击类型| 预认证 RCE 所需认证| 无 受影响版本 状态| 版本...
ShadowTech-Rat
ShadowTech-Rat 一个远程管理工具示例。...
Discord-Rat
仅供教育目的使用！！ Discord Rat - 安装指南 作者 : @deadconvicess | 打包者: deadconvicess 许可证 : MIT 你需要什么 1. 已安装 Python 3.11+ 2. 一个 Discord Bot Token https://discord.com/developers/applications 3. 一个 Discord Webhook URL Discord 频道 集成 Webhooks 4. 用于托管配置的 Pastebin 或 Gist 账户 安装说明 1. 创建一个 Pastebin/Gist，内容为： 第 1 行：你的...
pyFUD
pyFUD クロスプラットフォーム マルチクライアント FUD RAT 注記: このプロジェクトは活発に開発中です。いくつかのバグが含まれている可能性があります。 警告: 1. ペイロードをVirusTotal.comにアップロードしないでください。このツールは時間が経つと動作しなくなるため。 2. VirusTotalはアンチウイルス企業とシグネチャを共有します。 3. 繰り返しますが、愚か者にならないでください！ インストール: 1. git clone https://github.com/machine1337/pyFUD.git 2. python3 server.py...
njRAT
njRAT njRAT SRC 提取 一切风险自负。 请仅将其用于研究目的。...
Apollo
Apollo 一个用 Python 编写的简单、轻量级的远程访问工具 Apollo 是一个跨平台（Windows、Linux、FreeBSD 和 MacOS）的远程访问工具，适用于 Python 3.4+。其功能目前非常基础，但允许在后期利用阶段执行远程代码，并获取客户端系统的信息，将其报告回命令与控制服务器。 功能 能够同时控制多个客户端 跨平台（Windows、Linux、FreeBSD 和 macOS） 使用 AES-256 加密的 C2 通信，并带有 D-H 密钥交换 接受多个客户端的连接 远程命令执行 标准 Linux/Unix 工具（cat、ls、pwd、unzip、wget...