Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

ZoneMinder v1.37.* <= 1.37.64 - SQL Injection

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37. = 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65. id: CVE-2024-51482 info: name: ZoneMinder v1.37. = 1.37.64 - SQL Injection author...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

web-application-firewall-

Simulación de Cortafuegos de Aplicaciones Web Descripción general Este proyecto demuestra una simulación de un Cortafuegos de Aplicaciones Web WAF utilizando Flask y un verificador de vulnerabilidades para CVE-2017-5638. El middleware WAF bloquea solicitudes HTTP que contienen patrones específico...

CVEs

Lista de CVE CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Prueba de Concepto PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Prueba de Concepto PoC :...

CVE-2024-4577

CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...

CVE-2025-24813-POC

JSP Web Shell 上传器 一个简单的 Python 工具，用于通过 HTTP PUT 请求将一个基础的 JSP Web Shell 上传到一个或多个目标。 ⚠️ 仅用于教育和授权的渗透测试。 Apache Tomcat 存在路径等价/路径遍历漏洞，原因是未正确处理路径中的 ../ 序列。 CVE ID: CVE-2025-24813 Severity: 严重 Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg 🧰 功能 上传一个具有命令执行能力的基础 JSP Shell 支持： 单个目标 -t...

CVE-2012-1723

Navegador web drive-by que explota CVE-2012-1723 para ejecución remota de código. Puede encontrar un recorrido y detalles técnicos en https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

CVE-2026-10290-SQLI

Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...

vcenter-cve-2021-21980-lab

CVE-2021-21980 Entorno de Prueba Vulnerable Descripción General Entorno de prueba realista que simula la vulnerabilidad de salto de ruta path traversal del Cliente Web de VMware vSphere. ⚠️ ADVERTENCIA: Entorno de prueba vulnerable. ¡No lo expongas a Internet! Inicio Rápido Compilar y Ejecutar...

CVE-2026-57517-CWP

Exploit CVE-2026-57517 CWP Este repositorio contiene una herramienta de prueba de concepto basada en Go para probar un escenario conocido de vulnerabilidad de Control Web Panel CWP relacionado con CVE-2026-57517. La implementación apunta a una ruta de inyección SQL ciega e incluye el despliegue...

static-code-analysis-helper

Static-Code-Analysis-Helper Descripción Detecta funciones que probablemente causen metodologías de ataque en muchos lenguajes de programación web y frameworks de tu carpeta de proyecto. Te ayuda a realizar análisis de código estático. Nota : Muchas de las funciones descritas aquí pueden no causar...

kismet-docs

OBSOLETO Este repositorio ahora está fusionado en el repositorio kismet-web-docs, y todos los cambios futuros deben realizarse allí. El nuevo motor del sitio utiliza Hugo, y varias de las partes de la documentación se han convertido a datos YAML con plantillas...

dbdtct

dbgdtct Desctiption dbgdtct is a Python-based tool designed to help you detect if a web application is deployed in debug mode—a critical misconfiguration that can expose sensitive information and increase the risk of exploitation in production environments. Installation git clone...

CVE-2024-22909

CVE-2024-22909 : Online-Exam-System - 跨站脚本攻击 概念验证PoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md 概念验证PoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...

CrushFTP-auth-bypass-CVE-2025-31161

CrushFTP Authentication Bypass - CVE-2025-31161 A comprehensive toolkit for exploiting CVE-2025-31161, an authentication bypass vulnerability in CrushFTP that allows unauthorized user account creation. 🔍 What is CVE-2025-31161? CVE-2025-31161 is a critical authentication bypass vulnerability in...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE An optimized Python 3 Proof-of-Concept PoC exploit for WiFi Mouse Server v1.7.8.5. This script leverages an inherent protocol vulnerability to achieve Remote Code Execution RCE via automated keystroke injection. This version has been explicitly modified and tuned f...