CVE-2024-44000

CVE-2024-44000 LiteSpeed استيلاء غير مصرح به على الحسابات تم نشر PoC الآن. تم إنشاؤه لأغراض تعليمية/بحثية فقط! استخدمه على مسؤوليتك الخاصة!...

CVE-2024-43998

CVE-2024-43998 Description CVE-2024-43998 : Vulnérabilité d'autorisation manquante dans le thème Blogpoet permet d'accéder à des fonctionnalités non correctement restreintes par les ACL. Ce problème affecte les versions de Blogpoet de n/a à 1.0.3. Utilisation usage: CVE-2024-43998.py -h -u URL -p...

CVE-2020-13937

ثغرة الوصول غير المصرح به لواجهة برمجة تطبيقات Apache Kylin CVE-2020-13937 Fofa:title="Kylin" طريقة الاستخدام المساعدة: python3 cve-2020-13937.py --help فحص فردي: python3 cve-2020-13937.py -u http://127.0.0.1 فحص جماعي: python3 cve-2020-13937.py -f target.txt...

CVE-2026-80047

A flaw was found in the Hugging Face Transformers library. A remote attacker could exploit this vulnerability by enticing a user to load a model using the GenerativePreTrainedModel.loadcustomgenerate function. This function writes remote Python files to the local disk without requiring explicit...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Projet de démonstration 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and its...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - تجاوز المصادقة تشغيل الاستغلال USE: python3 exploit.py ⣀⡠⢤⡀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡴⠟⠃⠀⠀⠙⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠋⠀⠀⠀⠀⠀⠀⠘⣆⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠾⢛⠒⠀⠀⠀⠀⠀⠀⠀⢸⡆⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣶⣄⡈⠓⢄⠠⡀⠀⠀⠀⣄⣷⠀⠀⠀⠀⠀⠀...

CVE-2024-32444

CVE-2024-32444 Au 24/01/25, cette vulnérabilité ne dispose pas de correctif, il s'agit donc simplement d'un modèle de détection de produit, car tous les produits associés au thème wordpress RealHome sont vulnérables. Le thème permet aux utilisateurs de s'inscrire via la fonction...

CVE-2024-51435

bloodbank تم العثور على csrf poc بسيط على نظام blood bank system v 1.0...

SolarView Compact 6.00 - OS Command Injection

SolarView Compact 6.00 was discovered to contain a command injection vulnerability, attackers can execute commands by bypassing internal restrictions through downloader.php. id: CVE-2023-23333 info: name: SolarView Compact 6.00 - OS Command Injection author: Mr-xn severity: critical description: ...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

CVE-2023-23752

CVE-2023-23752 Joomla! уязвимость неавторизованного доступа POC：/api/index.php/v1/config/application?public=true Анализ уязвимости https://xz.aliyun.com/t/12175...

scan_CVE-2020-29583

Analyseur pour les produits Zyxel vulnérables en raison d'un compte utilisateur non documenté CVE-2020-29583 Détails de la vulnérabilité : https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Mais je ne suis pas sûr qu'il soit vraiment possible de se connecter avec zyfw...

PocList

تم إيقاف تحديث هذا المشروع مؤقتًا. عندما قمت بالتحديث في المراحل المتأخرة، أدركت مشكلتين: الأولى، يبدو أن إعلاني لقانون الأمن السيبراني في المستودع لم يكن كافيًا، مما أدى إلى نتائج لا أرغب في رؤيتها. الثانية، في بداية تصميم هذا المشروع، لم أأخذ في الاعتبار بعض الأمور المتعلقة بالبنية التحتية...

CVE-2024-30485

Exploit CVE-2024-30485 📌 Aperçu CVE-2024-30485 est une vulnérabilité de haute sévérité trouvée dans le plugin Finale Lite pour WordPress versions = 2.18.0. La vulnérabilité permet à des utilisateurs authentifiés Abonné+ d'installer et d'activer des plugins arbitraires sans autorisation appropriée...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - Spoof de contenu non authentifié CVE-2025-32259 🔬 Un PoC simple démontrant CVE-2025-32259 dans le plugin WP ULike pour WordPress. 🚨 Usage éducatif uniquement – ne testez pas sur des systèmes sans autorisation explicite. 🧠 Aperçu WP ULike est un plugin WordPress populaire qui...

CVE-2022-40684

CVE-2022-40684 POC pour CVE-2022-40684 affectant les appliances Fortinet FortiOS, FortiProxy et FortiSwitchManager. Analyse technique Une analyse technique de la cause racine de la vulnérabilité est disponible sur notre blog :...