The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. This allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

CVE-2025-3248-POC

CVE-2025-3248-POC CVE-2025-3248的POC 在目标机器上执行任意命令 用法: python poc.py 'http://xxx.com' 'ls /' 在受害者的电脑上留下一些爱 poc.py...

CVE-2024-21006

CVE-2024-21006 CVE-2024-21006 描述 Oracle Fusion Middleware 的 Oracle WebLogic Server 产品（组件：Core）中存在漏洞。受支持的受影响版本为 12.2.1.4.0 和 14.1.1.0.0。该漏洞易于利用，允许未经身份验证的攻击者通过 T3、IIOP 网络访问破坏 Oracle WebLogic Server。成功利用此漏洞的攻击可导致未经授权访问关键数据，或完全访问所有 Oracle WebLogic Server 可访问的数据。CVSS 3.1 基础评分为 7.5（影响机密性）。CVSS...

PIL-RCE-By-GhostButt

Explotando la vulnerabilidad de ejecución de comandos del módulo Python PIL Ataca aplicaciones Python desarrolladas con PIL y logra el efecto de ejecución remota de comandos. Este proyecto se utiliza para almacenar el paper y el código fuente y los Dockerfile utilizados en los experimentos. Paper...

cve-2019-1108

CVE-2019-1108 漏洞利用 root@kitploit: CVE-2019-1108 Remote Desktop Protocol Client Information Disclosure Vulnerability Published: 07/09/2019 | Last Updated : 11/19/2019 MITRE CVE-2019-1108 An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of...

CVE-2023-21837

CVE-2023-21837 POC、EXP，ChatGPT 为我生成 代码 root@kitploit: import socket CVE-2023-21837 def checkvulnerabilitytargethost, targetport: create socket object s = socket.socketsocket.AFINET, socket.SOCKSTREAM set timeout to 30 seconds s.settimeout30 try: connect to target s.connecttargethost, targetport...

CVE-2016-3088

CVE-2016-3088 Statement 一个基于Python的CVE-2016-3088利用脚本。 这是我的第一个脚本，所以可能有些地方不太合适。 但在我测试时它似乎运行正常。 Discription 该脚本可以在渗透CVE-2016-3088时省去抓包步骤， 从而让我们直接写入和移动文件。 Usage root@kitploit: python CVE-2016-3088.py --url http://ip:port/ --path absolutepath --script filename.txt 参数--script是可选的，如果不带该参数运行程序，它将使用内置的有效载...

CVE-2023-35078-Exploit-POC

PoC del exploit CVE-2023-35078 La vulnerabilidad de acceso remoto no autenticado a la API CVE-2023-35078 ha sido descubierta en Ivanti Endpoint Manager Mobile EPMM, anteriormente conocido como MobileIron Core. Esta vulnerabilidad afecta a todas las versiones compatibles: versión 11.4, lanzamiento...

Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capturehandle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without...

iboss Secure Web Gateway - Stored Cross-Site Scripting

A cross-site scripting vulnerability has been found in iboss Secure Web Gateway up to version 10.1. The vulnerability affects the /login file of the Login Portal component, where manipulation of the redirectUrl parameter leads to cross-site scripting. The attack can be launched remotely and the...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

Code-Projects School Fees Payment System 1.0 - SQL Injection

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...

MKdocs 1.2.2 - Directory Traversal

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

Remot3d

Remot3d - 一种简单的利用方式 即将更新 Remot3d — 一款用于生成后门的工具，用于控制和利用运行 PHP（超文本预处理器）程序的服务器。后门代码已被混淆处理，通常能达到 FUD（完全免杀）的效果。 由一位 16 岁青少年用 Shell 脚本语言（通常称为 BASH）编写。 捐赠 如果这个项目对你的渗透测试有帮助，并且你想支持我，可以请我喝杯咖啡 : PAYPAL : https://www.paypal.me/abdiprawiran PERFECT MONEY : U15461128 截图 Remot3d 功能列表 为 Windows 或 Linux 服务器创建后门（可...

CVE-2025-5777

🩸 CVE-2025-5777 - CitrixBleed 2 Citrix NetScaler / ADC 中的内存泄露漏洞 📌 1. 执行摘要 CitrixBleed 2 指的是一种严重的内存泄露漏洞，影响： 🏢 Citrix NetScaler ADC 🌐 NetScaler Gateway 🔐 面向互联网的 VPN 设备 该漏洞允许未认证的攻击者通过精心构造的网络请求从受影响设备中检索敏感内存内容。 此类问题在本质上与原始 CitrixBleed CVE-2023-4966 类似。 🧠 2. 受影响厂商与产品 受影响系统包括： Citrix NetScaler ADC Citri...

CVE-2015-1578

CVE-2015-1578 Achat 0.150 beta7 - 远程缓冲区溢出，为 PNPT 课程重写为 python3 版本。 原作者：KAhara MAnhara 重写者：Giuseppe Aloisi（python3 版本） Achat 0.150 beta7 - 缓冲区溢出 已在 Windows 7 32 位系统上测试 https://www.exploit-db.com/exploits/36025 给脚本几秒钟时间，它会给你一个反向 shell... 在代码中运行 msfvenom 命令 msfvenom -a x86 --platform Windows...