spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build wget...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

Dolibarr-17.0.0-Exploit-CVE-2023-30253

Readme.md CVE-2023-30253 CVE-2023-30253는 Dolibarr 소프트웨어의 보안 결함으로, 인증된 사용자가 주입된 데이터에서 대문자 변조 기술을 활용하여 원격 코드를 실행할 수 있게 합니다. 영향 이 취약점은 악의적인 공격자에 의한 무단 원격 코드 실행으로 이어질 수 있으며, 영향을 받는 시스템의 보안과 무결성에 심각한 위협을 가합니다. 이 취약점은 Dolibarr 17.0.1에서 수정되었습니다. 참고...

cve-2023-30253

CVE-2023-30253 설명 Dolibarr 17.0.1 이전 버전에서는 인증된 사용자가 대문자 조작을 통해 원격 코드 실행이 가능합니다: 주입된 데이터에 ?php 대신 ?PHP를 사용합니다. 문서 CVE-2023-30253 GitHub 권고: GHSA-9wqr-5jp4-mjmh 설정 git clone https://github.com/Rubikcuv5/cve-2023-30253.git pip3 install -r requirements.txt python3 CVE-2023-30253.py -h 사용법 usage:...

CVE-2023-30253-Exploit

CVE-2023-30253 エクスプロイト Dolibarr は大文字操作によるリモートコード実行の脆弱性があります 影響を受けるバージョン 17.0.1 使用方法: pip3 install -r requirements.txt python3 CVE-2023-30253.py...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process. An attacker can gain unauthorized access to sensitive configuration files by...

CVE-2026-39559

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

EUVD-2026-37688

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559

CVE-2026-39559 affects WordPress Uppercase theme versions prior to 1.2.2. The vulnerability is an unauthenticated Local File Inclusion (LFI) in the theme, enabling an attacker to access local files. Impact is denoted as high (CVSS 3.1: 8.1) with network attack vector, high complexity, and no user...

CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392 HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392

HAX CMS (PHP, pre-26.0.0) has a case-sensitivity mismatch in HTML upload handling. The saveFile endpoint validates extensions case-insensitively but the .htaccess rule enforcing Content-Disposition: attachment for HTML is case-sensitive. As a result, an uploaded HTML file with an uppercase extens...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

EUVD-2026-34883

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

PT-2026-47029

Name of the Vulnerable Software and Affected Versions HAX CMS PHP versions prior to 26.0.0 Description The saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim. However, the .htaccess rule designed to force Content-Disposition: attachment on HT...

HAX 安全漏洞

HAX is an open-source microsite managed using HAX+CMS with a PHP backend. Versions of HAX prior to 26.0.0 contained security vulnerabilities. These vulnerabilities stemmed from the saveFile endpoint’s validation mechanism, which does not distinguish between uppercase and lowercase file extensions...