270167 matches found
Netsweeper 4.0.5 - Default Weak Account
The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...
Popup Builder Plugin - SQL Injection and Cross-Site Scripting
The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...
Kramer VIAware - Privilege Escalation and Remote Code Execution
Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...
Kyocera TASKalfa printer - Path Traversal
CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. id: CVE-2023-34259 info: name: Kyocera TASKalfa printer - Path...
[SECURITY] Fedora 44 Update: chromium-154.0.8037.57-1.fc44
Chromium is an open-source web browser, powered by WebKit Blink...
web-application-firewall-
Web Application Firewall Simulation Overview This project demonstrates a Web Application Firewall WAF simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits th...
CVEs
CVE List CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md...
CVE-2024-4577
CVE-2024-4577 - Inyección de Argumentos RCE en PHP-CGI | | ---|---|--- CVE| Descripción| CVSSv3 CVE-2024-4577| Vulnerabilidad de Inyección de Argumentos en PHP-CGI| 9.8 | | "CVE-2024-4577 es una vulnerabilidad crítica de inyección de argumentos en PHP que puede ser explotada para lograr ejecución...
CVE-2025-24813-POC
JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...
CVE-2012-1723
Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...
CVE-2026-10290-SQLI
Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...
vcenter-cve-2021-21980-lab
CVE-2021-21980 Vulnerable Test Environment Overview Realistic test environment simulating VMware vSphere Web Client path traversal vulnerability. ⚠️ WARNING: Vulnerable test environment. Do NOT expose to internet! Quick Start Build and Run podman build -t vcenter-lab . podman run -d -p 443:443...
CVE-2026-57517-CWP
Exploit CVE-2026-57517 CWP Este repositorio contiene una herramienta de prueba de concepto basada en Go para probar un escenario conocido de vulnerabilidad de Control Web Panel CWP relacionado con CVE-2026-57517. La implementación apunta a una ruta de inyección SQL ciega e incluye el despliegue...
static-code-analysis-helper
Static-Code-Analysis-Helper Description It detects functions that are likely to cause attack methodologies in many web programming languages and frameworks in your project folder. Helps you perform static code analysis. Note : Many of the functions described here may not cause vulnerabilities...
kismet-docs
DEPRECATED This repo is now merged into the kismet-web-docs repo, and all future changes should go there. The new site engine uses Hugo, and a number of the documentation parts have been converted to YAML data with templates...
dbdtct
dbgdtct Descripción dbgdtct es una herramienta basada en Python diseñada para ayudarte a detectar si una aplicación web está desplegada en modo de depuración—una configuración incorrecta crítica que puede exponer información sensible y aumentar el riesgo de explotación en entornos de producción...
CVE-2024-22909
CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Prueba de ConceptoPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md Prueba de ConceptoPoC : https://github.com/BurakSevben/CVE-2024-22909/blob/main/CVE-2024-22909.md...
CrushFTP-auth-bypass-CVE-2025-31161
Bypass de Autenticación de CrushFTP - CVE-2025-31161 Un completo conjunto de herramientas para explotar CVE-2025-31161, una vulnerabilidad de bypass de autenticación en CrushFTP que permite la creación no autorizada de cuentas de usuario. 🔍 ¿Qué es CVE-2025-31161? CVE-2025-31161 es una...
MouseServer-1.7.8.5-RCE
WiFi Mouse Server 1.7.8.5 - RCE An optimized Python 3 Proof-of-Concept PoC exploit for WiFi Mouse Server v1.7.8.5. This script leverages an inherent protocol vulnerability to achieve Remote Code Execution RCE via automated keystroke injection. This version has been explicitly modified and tuned f...