dell-emc_recoverpoint

Dell EMC RecoverPoint エンタープライズデータ保護プラットフォーム向けエクスプロイト Dell EMCの開示情報で言及されている、RecoverPointエンタープライズデータ保護プラットフォームにおける以下の脆弱性を発見しました。 http://seclists.org/fulldisclosure/2018/May/61 ユーザー名へのコマンドインジェクションによる、認証不要のroot権限付きリモートコード実行 CVE-2018-1235, CVSS 9.8, 深刻度: 重大...

CVE-2024-57522

CVE-2024-57522 - Users.php에 저장된 XSS 취약점 - SourceCodester Packers and Movers Management System 1.0 설명 이 저장소는 SourceCodester 의 Packers and Movers Management System 1.0 에 존재하는 저장형 교차 사이트 스크립팅XSS 취약점에 대한 개념 증명PoC을 포함합니다. 해당 취약점은 Users.php 엔드포인트에 존재하며, 공격자가 사용자 생성 시 사용자 이름 또는 이름 필드에 악성 스크립트를 주입할 수 있습니...

CVE-2023-46451

CVE-2023-46451 Descrizione suggerita Sourcecodester Best courier management system v1.0 è vulnerabile a Cross Site Scripting XSS nel campo di modifica del nome utente. Informazioni aggiuntive Qui aggiorno il video POC su YouTube: https://youtu.be/f8B3m5YfqI Tipo di vulnerabilità Cross Site...

CVE-2017-8367

CVE-2017-8367 PoC exploit per la vulnerabilità CVE-2017-8367 della funzionalità di registrazione di Easy Mov Converter: buffer overflow basato su stack. Utilizzo Esegui lo script e verrà creato il file POCPayload.txt contenente il payload. root@kitploit: python3 payloadgeneratorCVE-2017-15950.py...

CVE-2007-2447

CVE-2007-2447 Samba 3.0.0 - 3.0.25rc3 estão sujeitos à Vulnerabilidade de Injeção Remota de Comandos CVE-2007-2447, que permite que atacantes remotos executem comandos arbitrários ao especificar um nome de usuário contendo metacaracteres de shell...

CVE-2007-2447-in-Python

CVE-2007-2447 - Implementazione in Python Descrizione Implementazione in Python dell'exploit RCE 'Username' map script' per Samba 3.0.20 IP - IP della macchina remota. PORT - Opzionale Porta su cui smb è in esecuzione. PAYLOAD - Payload da eseguire sulla macchina remota, ad esempio reverse shell...

CVE-2025-51396

Titolo dell'exploit: LiveHelperChat =4.61 - Cross-Site Scripting persistente XSS tramite nome utente del bot Telegram Data: 09/06/2025 Autore dell'exploit: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Homepage del venditore:...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC di CVE-2026-64638 Proof of Concept educativa della catena XSS2Shell CVE-2026-64638, vulnerabilità pre-autenticazione XSS → RCE nel WordPress Core scoperta in modo autonomo da pwn.ai e divulgata il 7 agosto 2026. Indice dei contenuti 1. Sommario esecutivo 2. Avviso legale 3...

CVE-2026-71958 D-Link DWR-M961 Buffer Overflow via quicksetup.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

EUVD-2026-54810

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

UBUNTU-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 is affected by a stored XSS in the login failure path. An unauthenticated attacker can submit a crafted username, which is recorded in the audit log and later rendered unescaped via innerHTML in the administrator notification panel. The permissive CSP (allowing inline ev...

CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

CVE-2026-62184 luci-app-banip Log Monitor IP Extraction Bypass

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

PT-2026-57886

Name of the Vulnerable Software and Affected Versions luci-app-banip versions 0 through 0.11.1 Description A log parsing flaw exists where the awk-based parser extracts the first IPv4 address from log lines regardless of its field position. This allows an unauthenticated remote attacker to inject...

PYSEC-2026-1234 Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

CVE-2026-57275

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

CVE-2026-57273

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...