270180 matches found
CVE-2026-94132
The AcyMailing Enterprise extension for Joomla (versions 1.0.0 – 11.0.5 ) contains a Remote Code Execution (RCE) vulnerability. The root cause is that the mailbox actions in POP3 mode save incoming MIME attachments to the media/com_acym/upload/ directory without performing extension checks. This ...
CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...
[SECURITY] [DLA 4797-1] lemonldap-ng security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4797-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 26, 2026 https://wiki.debian.org/LTS -...
CVE-2019-11287
CVE-2019-11287: RabbitMQ Web管理插件中的堆溢出导致拒绝服务 Pivotal RabbitMQ 版本 3.7.x 低于 3.7.21 和 3.8.x 低于 3.8.1，以及 RabbitMQ for Pivotal Platform 的 1.16.x 版本低于 1.16.7 和 1.17.x 版本低于 1.17.4，包含一个易受拒绝服务攻击的 Web 管理插件。 可以利用 "X-Reason" HTTP 头部插入恶意的 Erlang 格式字符串，该字符串会扩展并消耗堆内存，导致服务器崩溃。 厂商披露： 该漏洞的厂商披露和修复方案可在此处找到here。 条件：...
CVE-2016-3113
CVE-2016-3113 PoC 这是一个利用 oVirt 网络界面（RedHat）中反射型 XSS 漏洞的概念验证。在该 PoC 中，将通过受害者的浏览器会话启动 oVirt IaaS 环境中的一台虚拟机。由于时间紧迫，JS 代码保持简单。 更多信息请访问： https://www.itskritis.de/uploads/jk17/StudentsFreigabeversion/DURMAZPraesentation.pdf（德语幻灯片） https://access.redhat.com/security/cve/cve-2016-3113...
Flangvik
Flangvik C POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…...
Chamilo-LMS-CVE-2023-4220-Exploit
Chamilo LMS CVE-2023-4220 漏洞利用 概述 该脚本利用了 Chamilo LMS 版本 ≤ v1.11.24 中的一个远程代码执行（RCE）漏洞。该漏洞（CVE-2023-4220）源于 Chamilo LMS 的 bigUpload.php 功能中存在的无限制文件上传漏洞，允许攻击者上传任意文件（如 Web Shell）并执行，从而导致服务器完全被远程代码执行。 该脚本由 Divine Clown 进行了增强，以简化利用过程，自动生成反向 Shell 文件，上传到目标，并启动监听器，使攻击者能够直接访问 Shell。 CVE 详情 CVE ID...
CVE-2019-5029
CVE-2019-5029 这是针对 CVE-2019-5029 的 Python 脚本 PoC。它是 Exhibitor Web UI 1.7.1 的 RCE 利用程序。 如何使用 克隆此仓库 git clone https://github.com/yZ1337/CVE-2019-5029.git 按如下方式执行 python3 CVE-2019-5029.py 确保脚本中的请求与配置的请求一致。...
ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks
ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor...
CVE-2022-42889
快速开始 sudo apt install golang 像运行 Python 一样运行： go run main.go arg1 arg2 构建可执行文件： go build main.go 用法： non@woa:/program$ go run main.go - Usage: ./program vulnerable/web?param= 'ls -la' 待办事项： 反向 Shell 功能 https://gobyexample.com/spawning-processes 更好的错误处理，已知存在一个逻辑错误：如果将 ?search 改为 ?sea，程序流程仍会到达命令成功结...
EUVD-2026-87690
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...
CVE-2023-24249-PoC
CVE-2023-24249 概念验证 CVE-2023-24249 是 laravel-admin v1.8.19 中的一个任意文件上传漏洞。该概念验证利用此漏洞上传 Web Shell。 该漏洞利用程序是为针对 HackTheBox 的简单机器 Usage 而编写的。 示例 python3 CVE-2023-24249.py + Web shell uploaded to http://admin.usage.htb/uploads/images/df18111ffa9f40264b52624c7d7d21b1.php curl...
CVE-2026-49049
CVE-2026-49049 本仓库包含一个基于 Python 的扫描器和概念验证，针对 Joomla Helix3 组件中的一个漏洞。该漏洞是一个任意文件写入问题，当攻击者能够将 PHP 载荷写入 Web 可访问的位置时，可能导致远程代码执行（RCE）。 漏洞是什么 当请求参数被用于控制文件路径或文件内容且缺乏适当验证时，就会出现该漏洞行为。在 Helix3 AJAX 接口的情况下，该端点接受可能被用于将文件写入服务器文件系统的数据。如果应用程序不限制目标路径且不验证内容，攻击者就可以在 Web 服务器会执行的位置创建恶意 PHP 脚本。...
Astra Linux – Vulnerability in Chromium
The confused deputy in Prerender in Google Chrome before version 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in the Network of Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to leverage social engineering to bypass web origin policy through crafted network traffic. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...