authz0

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers...

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---未授权密码重置 漏洞信息 WordPress 的密码重置功能存在一个漏洞，在某些情况下可能允许攻击者在无需事先认证的情况下获取密码重置链接。 此类攻击可能导致攻击者未经授权访问受害者的 WordPress 账户。...

CVE-2025-0108-PoC

CVE-2025-0108 Prueba de Concepto PoC Este repositorio contiene una Prueba de Concepto PoC para la vulnerabilidad CVE-2025-0108 , que es un problema de omisión de autenticación en el software PAN-OS de Palo Alto Networks. Los scripts proporcionados aquí prueban la vulnerabilidad enviando una...

CVE-2021-43798

CVE-2021-43798 por Privacy Hunter Versiones afectadas: Grafana 8.0.0-beta1 a 8.3.0 excepto versiones parcheadas Tipo de vulnerabilidad: Directory Traversal Recorrido de directorio Gravedad: Crítica Plataforma: Grafana plataforma de monitoreo y observabilidad de código abierto ⚠️ Detalles de la...

CVE-2020-9496

CVE-2020-9496 ApacheOfBiz 17.12.01 - Ejecución remota de código no autorizada Las solicitudes XML-RPC son vulnerables a una deserialización insegura. Pasos Paso 1: pip3 install -r requeriments.txt Paso 2: nc -nlvp equipo atacante Paso 3: python3 shell.py -i -p -li -lp Paso 4: Deberías tener una...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei 模板 Joomla CVE-2023-23752 - 一个请求参数突破 Rest API 受影响版本 Joomla 大致有三个路由入口，分别是： 1. 根目录下的 index.php（用户访问文章） 2. 根目录下的 administrator/index.php（管理员管理） 3. 根目录下的 api/index.php（供开发者使用的 Rest API） 未授权接口正是第三个入口。因此，只有 Joomla 4.0.0 至 Joomla 4.2.7 受影响（Rest API 4.x 为官方开发） 在此发送请求...

CVE-2024-30998

PHPGurukul 男士沙龙管理系统 2.0 欢迎来到 PHPGurukul 男士沙龙管理系统 2.0 仓库。该项目旨在为男士沙龙管理提供一个健壮的系统。 安全漏洞 CVE-2024-30998 描述：通过 'email' 参数易受 SQL 注入攻击。 受影响版本：2.0 影响：攻击者可以操控 'email' 参数，可能获得未经授权的访问。 解决方案：实施适当的输入验证并使用参数化查询...

CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Docker 容器命令执行工具 一个功能强大的 Docker 远程 API 漏洞利用工具，用于 CVE-2025-9074 漏洞的安全研究和测试。 核心优势 ✅ 全自动容器生命周期管理 ：自动创建临时容器，操作完成后自动清理，不留痕迹 ✅ 智能路径处理 ：自动识别并转换 Windows 路径为 Docker 挂载格式 ✅ 全自动化操作流程 ：无需手动输入复杂命令，菜单式交互，一键完成文件操作 ✅ 跨平台兼容 ：完美支持 Windows 和 Linux 系统 部分功能效果图 功能特性 容器操作 查看运行中的容器 查看所有容器（包括停止的） 创建新容器 停止容器...

CVE-2025-58780

CVE-2025-58780 Divulgación de vulnerabilidad: Inyección SQL en ScienceLogic Resumen Este documento describe una vulnerabilidad de inyección SQL divulgada de manera responsable encontrada en la plataforma web de ScienceLogic. La vulnerabilidad ha sido reportada a los mantenedores del proyecto de...

CVE-2024-7029

Herramienta PoC para explotar CVE-2024-7029 en dispositivos AvTech 🎤 Traducción del README Inglés فارسی 📸 Captura de pantalla 💎 Introducción CVE-2024-7029 destaca un grave problema de seguridad en los dispositivos AVTech, donde los atacantes pueden omitir la autenticación y ejecutar comandos...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

CVE-2024-35511

PHPGurukul Men Salon Management System 2.0 Bienvenido al repositorio de PHPGurukul Men Salon Management System 2.0. Este proyecto tiene como objetivo proporcionar un sistema robusto para la gestión de salones masculinos. Vulnerabilidades de seguridad CVE-2024-35511 Descripción: Vulnerable a...

CVE-2020-11444

CVE-2020-11444 Nexus 3 越权漏洞利用脚本 更多脚本文件另参：https://github.com/zhzyker/exphub Readme root@kitploit: +-----------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-11444 Nexus 3 Unauthorized Vuln...

CVE-2021-45232

Vulnerabilidad de acceso no autorizado en Apache APISIX Dashboard CVE-2021-45232 Consulta FOFA title="Apache APISIX Dashboard" Versiones afectadas Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export Recomendaciones de mitigación Actualice a la versión segura más...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...