CVE-2025-52357

CVE-2025-52357 : Aviso de seguridad: XSS en la consola de administración del router FD602GW-DX-R410 Prueba de concepto y aviso de seguridad para la vulnerabilidad de XSS reflejado en la consola de administración del router de fibra FD602GW-DX-R410 firmware V2.2.14. Incluye detalles, impacto y guí...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Bypass de Autenticación en Openfire Este repositorio destaca un problema de seguridad grave que afecta a varias versiones de Openfire. Openfire, un servidor de colaboración en tiempo real multiplataforma que utiliza el protocolo XMPP desarrollado por la comunidad Ignite Realtime,...

cve-2023-42820

cve-2023-42820 JumpServer Affected Versions v2.24 - v3.6.4 Impact With knowledge of the email associated with the JumpServer admin user account default: admin/[email protected], it is possible to reset the admin password through this vulnerability, and by combining it with JumpServer's...

CVE-2023-32315

CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author phith0n and K3ysTr0K3R Description Openfire is an XMPP server licensed under the Open Source...

CVE-2020-17453-PoC

CVE-2020-17453 La consola de administración de WSO2 hasta la versión 5.10 permite XSS a través del parámetro msgId en carbon/admin/login.jsp. PoC Prueba de Concepto root@kitploit: https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Descubridores Nombre: Jackson Henry Twitter: @JacksonHHax...

OpenFire_Decrypt

OpenFireDecrypt Descifrado de contraseñas de cuentas del panel de administración de OpenFire Instalar openfire https://hub.docker.com/r/sameersbn/openfire docker pull sameersbn/openfire:3.10.3-19 root@kitploit: docker run --name openfire -d --restart=always \ --publish 9090:9090 --publish 5222:52...

Oracle iPlanet Web Server 7.0.x - Image Injection

Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. id: CVE-2020-9314 info: name: Oracle iPlanet Web Server 7.0.x - Image Injection author:...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

Glassfish-research

GlassFish Security Research Vulnerability research on the Eclipse GlassFish administration console...

CVE-2026-2586

Inyección EL Autenticada en GlassFish RCE CVE-2026-2586 Una vulnerabilidad de Inyección de Lenguaje de Expresiones en la Consola de Administración de GlassFish permite a un usuario autenticado inyectar expresiones EL maliciosas en los parámetros procesados por la interfaz web administrativa. Una...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2020-8816

CVE-2020-8816 Un script de Python para explotar CVE-2020-8816, una vulnerabilidad de ejecución remota de código en Pi-hole. Este script utiliza las técnicas encontradas por François Renaud-Philippon para lograr la ejecución remota de código en un Pi-hole que ejecute una versión de la interfaz web...

CVE-2023-32315

CVE-2023-32315 Openfire's administrative console the Admin Console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environmentin an already configured Openfi...

CVE-2026-2587-Exploit-POC

CVE-2026-2587 Exploit PoC — Validador de inyección EL/RCE en Eclipse GlassFish Validador PoC seguro para CVE-2026-2587, un problema crítico de inyección EL/RCE que afecta el manejo de gadgets de la consola de administración de Eclipse GlassFish a través de /common/gadgets/gadget.jsf. Esta...

CVE-2026-84839

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-84839

tsi-coop tsi-dpdp-cms (up to 0.5.0 ) is affected by a missing authentication vulnerability in the web.xml file of the Admin Console/DPO Compliance Console component. A remote attacker can access the console without authentication, leading to a partial confidentiality impact. The exploit has been ...

CVE-2026-84839 tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...