CVE-2021-44228_PoC

POC per CVE-2021-44228 Questo script Python è stato creato mentre lavoravo sulla stanza TryHackMe per Log4j. Sebbene sia stato creato con variabili predefinite per questa stanza, ho usato argparse per rendere lo script versatile per una richiesta GET. Tutte le variabili necessarie possono essere...

Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion

Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the "GET /...." substring. id: CVE-2022-26233 info: name: Barco Control Room Management Suite =2.9...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit von kaal Exploits 1. HotelDruidExploit.py Dieser Exploit erstellt einen neuen Raum mit unserem PHP-Payload als Raumnamen. Verwendung: $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Sicherheitshinweis: Unzureichende Zugriffskontrollen ermöglichen unbefugtes Löschen von Räumen Let's Chat Zugewiesene CVE-ID: CVE-2026-66751 Zusammenfassung DELETE /rooms/:room führt über die Anforderung einer Anmeldung hinaus keinerlei Autorisierungsprüfung durch. Jedes Konto kann jeden Raum auf...

CVE-2023-33408

CVE-2023-33408 Minical 1.0.0 ist anfällig für gespeichertes Cross-Site-Scripting XSS Anbieter: https://github.com/minical/minical Demo-Anwendung: https://demo.minical.io/ PoC Schritt 1: Melden Sie sich bei der Minical-Anwendung an und navigieren Sie zu Raum-Raumstatus. Schritt 2: Klicken Sie auf...

BreakEscape

BreakEscape Rails Engine Cybersecurity-Schulungs-Escape-Room-Spiel als einbindbare Rails Engine. Funktionen 24+ Cybersecurity-Escape-Room-Szenarien Serverseitige Fortschrittsverfolgung mit 2-Tabellen-Schema Zufällige Passwörter pro Spielinstanz via ERB JIT-Ink-Skriptkompilierung für NPC-Dialoge...

readme2demo

readme2demo — tutorial verificati e video demo dal tuo README ▶ readme2demo che genera il proprio tutorial: un agente AI esegue il README di questo repository in una sandbox, un contenitore fresco riproduce ogni passaggio, quindi viene renderizzato il demo. Output completo dell'auto-esecuzione in...

CPSC253_CybersecurityFinalProjectReports

Einleitung Diese Unterlagen waren Teil meines Abschlussprojekts für meinen Cybersicherheitskurs: CPSC 253 - Grundlagen und Prinzipien der Cybersicherheit Die Prämisse meines Abschlussprojekts war, dass ich ein neu eingestellter Berater in einem Forschungszentrum war und half, deren Sicherheit run...

TryHackMe-Solar-exploiting-log4j-

Este repositorio nao tem um README...

CVE-Research

TryHackMe Room - tryhackme.com/jr/cvechallenge Video -...

CVE-2022-22909

CVE-2022-22909 Descrizione È stata trovata una vulnerabilità di Code Injection nell'applicazione Hotel Druid v3.0.3, che un attaccante potrebbe sfruttare per eseguire codice remoto sul server. Per uno sfruttamento riuscito, un attaccante deve avere il privilegio di aggiungere una nuova stanza...

CVE-2026-46382

A flaw was found in the Meeting Room Booking System MRBS. This vulnerability, known as Server-Side Request Forgery SSRF, allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized...

CVE-2026-46688

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382

MRBS prior to v1.12.2 is vulnerable to server-side request forgery during import, where a user-supplied private/local URI can be fetched without validation. The fixed version is v1.12.2; no workaround is listed in the provided documents. Remediation: upgrade to v1.12.2 or newer as stated in the s...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46688 Meeting Room Booking System has an unauthenticated open redirect

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

CVE-2026-46688

CVE-2026-46688 affects the Meeting Room Booking System (MRBS) prior to version 1.12.2, where an unauthenticated request can trigger a redirect to a caller-controlled URL. This open redirect could lead users to attacker-specified sites, including a spoofed MRBS login page. The issue is fixed in MR...

CVE-2026-72919 Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public...

CVE-2026-72919

Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 exposes a broken access control in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission could convert an unrelated public channel by providing channelName instead ...