CVE-2024-4577

Orange Tsi 🍊 تم اكتشاف هذه الثغرة بواسطة Orange Tsai @orange8361 من DEVCORE @d3vc0r3. تأكد من متابعة أبحاثه المتميزة، بينما كان دورنا هو فقط إعادة إنشاء وتطوير الاستغلال لهذه المشكلة. تنبيه أمني: CVE-2024-4577 ثغرة حقن وسائط PHP CGI نظرة عامة CVE-2024-4577 هي ثغرة خطيرة في PHP تؤثر على تكوينات CG...

GetBlocked

GetBlocked! Cleaner pages. Fewer trackers. Local-only. GetBlocked! is a lightweight, local-only Chrome extension that helps reduce common third-party website tracking by blocking known tracker requests, cleaning tracking links, and explaining tracking attempts. An optional experimental Decoy Mode...

kadimus

kadimus LFI स्कैन और शोषण उपकरण kadimus एक उपकरण है जो LFI कमजोरियों की जाँच और शोषण के लिए है, जिसमें PHP सिस्टम पर ध्यान केंद्रित किया गया है। विशेषताएँ: सभी URL पैरामीटर की जाँच करें /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE expect://cmd RCE स्रोत कोड प्रकटीक...

Navidrome < 0.53.0 - Authenticated SQL Injection

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not...

CVE-2023-24488

CVE-2023-24488 POC لـ CVE-2023-24488 إعادة التوجيه المفتوحة وXSS في Citrix Gateway CVE-2023-24488 لا تتم معالجة معاملات استعلام عنوان URL بشكل كافٍ قبل وضعها في ترويسة HTTP Location. يمكن للمهاجم استغلال ذلك لإنشاء رابط يؤدي، عند النقر عليه، إلى إعادة توجيه الضحية إلى موقع عشوائي. بدلاً من ذلك،...

swagger-ui

परिचय: Swagger UI की भूमिका Swagger UI एक व्यापक रूप से उपयोग की जाने वाली लाइब्रेरी है जो OpenAPI पूर्व में Swagger विनिर्देशों को एक इंटरैक्टिव वेब इंटरफ़ेस में प्रस्तुत करती है। यह डेवलपर्स और इंटीग्रेटर्स को बैकएंड कार्यान्वयन के बिना API का अन्वेषण और परीक्षण करने में सक्षम बनाती है।...

CVE-2020-12124

CVE-2020-12124 تطبيق لإثبات المفهوم لـ CVE-2020-12124 https://vulners.com/cve/CVE-2020-12124 ما يلي هو تحديث لـ CVE-2020-12124، وهي ثغرة تستغل حقن الأوامر في جهاز التوجيه Wavlink WN530H4 حيث يتم أخذ معلمات معينة من معلمات عنوان URL في طلب ويب إلى نقطة النهاية /cgi-bin/liveapi.cgi ووضعها في سطر...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange सर्वर-साइड रिक्वेस्ट फोर्जरी के प्रति संवेदनशील पेलोड : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

CVE-2024-2997

CVE-2024-2997 スキャナー 概要 CVE-2024-2997 スキャナーは、Webアプリケーションのコマンドインジェクション脆弱性を検出するために設計された高度な脆弱性スキャナーです。このツールは、セキュリティ専門家がアプリケーションの潜在的なセキュリティリスクを特定するのに役立ちます。 免責事項 このツールは教育目的のみ を対象としています。所有しているアプリケーション、またはテストの許可を得たアプリケーションに対してのみ使用してください。作者は、このツールの誤用またはそれによって生じた損害について一切責任を負いません。 特徴 高性能スキャン :...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-95813 e621ng before 26.09.16 Open Redirect via URL Parameters

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-95813 e621ng before 26.09.16 Open Redirect via URL Parameters

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-95813 e621ng before 26.09.16 Open Redirect via URL Parameters

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...

CVE-2026-52775

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

EUVD-2026-71807

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

PT-2026-83748

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An...

PT-2026-83847

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...