Allied Telesis AT-GS950/8 - Local File Inclusion

Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 is susceptible to local file inclusion via its web interface. id: CVE-2019-18922 info: name: Allied Telesis AT-GS950/8 - Local File Inclusion author: 0xAkoko severity: high description: | Allied Telesis AT-GS950/8 until Firmware AT-S107...

CVE-2025-31161

CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit 📌 Description This Python exploit targets CrushFTP servers vulnerable to CVE-2025-31161. The vulnerability allows unauthenticated user account creation by sending a crafted XML payload to the WebInterface, potentially resulting...

CVE-2015-20129 CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...

CVE-2015-20129

CrushFTP versions before 7.3.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to disabled CSRF protection by default. An attacker can lure an authenticated administrator to a malicious page that automatically submits POST requests to the /WebInterface/function/ endpoint. This allo...

CVE-2015-20129 CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...

CrushFTP CVE-2025-31161 auth bypass user creation

CVE-2025-31161: crafted CrushAuth / AWS4 Authorization headers allow unauthenticated setUserItem on /WebInterface/function/, creating a new FTP/WebInterface user. Default is detect-only; set confirm=true to create the configured account destructive. !/usr/bin/env python3 -- coding: utf-8 --...

CrushFTP CVE-2025-31161 Detect

Detects CrushFTP WebInterface auth bypass user creation chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CrushFTP WebInterface auth bypass user creation chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name"...

Loxone WebInterface Panel - Detect

Detects Loxone WebInterface Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Loxone WebInterface Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Loxone WebInterface Panel - Detect'...

CrushFTP WebInterface Panel - Detect

CrushFTP WebInterface login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP WebInterface login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CrushFTP WebInterface Panel...

Thruk Monitoring Webinterface - Cross-Site Scripting Detection

Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/.""" from...

EUVD-2012-1063

Malware in sbrugna...

EUVD-2018-4089

Malware in sbrugna...

EUVD-2012-1062

Malware in sbrugna...

EUVD-2025-10978

Malicious code in bioql PyPI...

EUVD-2023-12941

Malicious code in bioql PyPI...

CVE-2012-1025

Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter...

CVE-2025-32102

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...

CVE-2025-32103: Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions...

CVE-2025-32102: Server-Side Request Forgery (SSRF)

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...

CVE-2024-39915 Authenticated remote code execution in Thruk

Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application...