CVE-2025-24893-

CVE-2025-24893- CVE-2025-24893 | XWiki 플랫폼의 원격 코드 실행 취약점 개념 증명...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics OWA 1.7.3의 인증되지 않은 RCE 취약점을 위한 익스플로잇입니다. 이 작업은 https://devel0pment.de/?p=2494 를 기반으로 합니다. 면책 조항: 이 스크립트는 시스템의 보안을 감사하기 위해 제작되었습니다. 이 스크립트는 본인 소유의 시스템 또는 익스플로잇 수행에 대한 서면 허가를 받은 시스템에서만 사용하십시오...

CVE-2025-48703

CVE-2025-48703 CVE-2025-48703은 CentOS Web PanelCWP의 심각한 취약점으로, 인증되지 않은unauthenticated 공격자가 인증 메커니즘을 우회하고 시스템 명령을 실행하여 원격 코드 실행RCE을 수행할 수 있게 합니다. 이 취약점은 CWP 0.9.8.1204 이하 버전에 영향을 미치며, 최신 버전 0.9.8.1205에서 패치되었습니다. Shodan 크롤러: shodan download --limit 206765 list-targets "Server: cwpsrv" shodan parse...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

crackerjack

!CAUTION 이 저장소는 유지보수되지 않습니다. 최신 버전은 https://github.com/sadreck/crackerjack 를 방문하세요. CrackerJack Context Information Security의 Hashcat 웹 인터페이스 목차 소개 아키텍처 기능 제한 사항 설치 문제 해결 스크린샷 라이선스 소개 CrackerJack은 Python으로 개발된 Hashcat용 웹 GUI입니다. 아키텍처 이 프로젝트는 GUI와 Hashcat을 독립적으로 유지하는 것을 목표로 합니다. 간단히 말하면 다음과 같이...

CVE-2020-7246

실험실 설정: a git clone https://github.com/pswalia2u/CVE-2020-7246.git b cd CVE-2020-7246 && docker build -t cve-assignment:ine . && docker run -it -p 80:80 cve-assignment:ine c 웹 서버는 http://127.0.0.1/index.php 에서 접근 가능해야 합니다. d 사전 설정된 계정: 이메일: [email protected] 비밀번호: developer1 공격: 예전 python2...

CVE-2019-1332

CVE-2019-1332: Microsoft SQL Server Reporting Services의 반사형 교차 사이트 스크립팅Reflected Cross-Site Scripting 취약점 Microsoft SQL Server Reporting ServicesSSRS가 영향을 받는 SSRS 서버로 전송되는 특수하게 조작된 웹 요청을 제대로 삭제하지 않을 때 XSS교차 사이트 스크립팅 취약점이 존재합니다. 이 취약점을 성공적으로 악용한 공격자는 대상 사용자의 컨텍스트에서 스크립트를 실행할 수 있습니다. 이러한 공격을 통해 공격자...

Honeywell PM43 Printers - Command Injection

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006 id:...

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. id: CVE-2018-8006 info: name: Apache ActiveMQ =5.15.5 - Cross-Site...

Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process...

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

Socomec DIRIS A-40 Devices Password Disclosure

Socomec DIRIS A-40 devices before 48250501 are susceptible to a password disclosure vulnerability in the web interface that could allow remote attackers to get full access to a device via the /password.jsn URI. id: CVE-2019-15859 info: name: Socomec DIRIS A-40 Devices Password Disclosure author:...

TIBCO JasperReports Library - Directory Traversal

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for...

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands. id: CVE-2025-34030 info: name: sar2html...

WAVLINK WN530H4 live_api.cgi - Command Injection

A remote command-line injection vulnerability in the /cgi-bin/liveapi.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. id: CVE-2020-12124 info: name: WAVLINK WN530H4 liveapi.cgi - Command Injection author...