CVE-2024-39306

Descrizione Questo script è un PoC per CVE-2024-39306, dove è possibile un RCE a causa di una SQL injection tramite cui un utente autenticato può eseguire comandi arbitrari su un server che esegue ChurchCRM -p -b -c Esempio: python3 CVE-2024-39306.py -u FirstLast -p Password123 -b...

CVE-2024-51026_Overview

CVE-2024-51026 - Vulnerabilità di Cross Site Scripting XSS in NetAdmin IAM Descrizione Il sistema NetAdmin IAM versione 4.0.30319 presenta una vulnerabilità di Cross Site Scripting XSS nell'endpoint /BalloonSave.ashx, dove è possibile iniettare un payload dannoso nel campo Content=. Qualsiasi...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting

iBuildApp WordPress plugin through 0.2.0 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13326 info:...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

DbGate - Remote Code Execution via Dynamic Import Bypass

DbGate versions = 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import. id:...

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

RRAS-VULNERABILITY-CVE-2026-25172-CVE-2026-25173-CVE-2026--26111

Laboratorio di simulazione delle vulnerabilità RRAS di Windows 11 CVE-2026-25172, CVE-2026-25173, CVE-2026-26111 ⚠️ IMPORTANTE – Solo uso didattico e difensivo Questa guida serve per creare un ambiente di laboratorio isolato e controllato per comprendere le vulnerabilità di integer overflow nello...

CVE-2020-9461

CVE-2020-9461 root@kitploit: ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ XSS Memorizzato - Oempro Octech Oempro dalla versione 4.7 alla 4.11 permette XSS memorizzato da parte di un utente...

CVE-2024-54679

CVE-2024-54679 CVE-2024-54679 - CyberPanel noto anche come Cyber Panel Negazione del Servizio Descrizione Una vulnerabilità di negazione del servizio DoS è stata scoperta in Cyber Panel che consente a qualsiasi utente autenticato di riavviare il database inviando richieste all'endpoint...

CVE-2021-44103

CVE-2021-44103 Una prova di concetto per KONGA 0.14.9 - Elevazione dei privilegi. Introduzione Il 16 novembre 2021, Fabrício Salomão e io abbiamo trovato una vulnerabilità in Konga API Gateways, che consente a qualsiasi utente autenticato di diventare amministratore. Segnala la vulnerabilità...

EUVD-2026-68048

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2024-3656

Keycloak 24.0.5 è vulnerabile alla vulnerabilità di Broken Access Control, dove un attaccante può utilizzare qualsiasi utente autenticato per eseguire alcune azioni API come: Test delle connessioni LDAP tramite l'endpoint testLDAPConnection. Recupero degli attributi non gestiti di qualsiasi utent...

CVE-2021-38163

CVE-2021-38163 CVE-2021-38163 - exploit per SAP NetWeaver SAP NetWeaver Visual Composer 7.0 RT versioni - 7.30, 7.31, 7.40, 7.50, senza restrizione, un utente autenticato come utente non amministrativo può caricare un file dannoso tramite rete e innescarne l'elaborazione, che è in grado di esegui...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...

adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...