CVE-2021-26828_ScadaBR_RCE

PoC CVE-2021-26828ScadaBR원격코드실행 ScadaBR 0.9.1 Linux 및 1.0, 1.12.4CE Windows 버전은 원격 인증 사용자가 'viewedit.shtm'을 통해 임의의 JSP 파일을 업로드하고 실행하여 원격 코드 실행을 허용합니다. 익스플로잇 사용법 명령어: Windows: $ sudo python WinScadaRCE.py Linux: 먼저 로컬 머신에서 익스플로잇 실행 전에 임의의 포트를 엽니다: $ sudo nc -vnlp 4444 $ sudo python LinScadaRCE.py ...

CVE-2026-29115

CVE-2026-29115 — Dahua 인증 원격 서비스 거부 보고 유형: 공급업체 조정 보안 공개 CVE ID: CVE-2026-29115 공급업체: Dahua Technology 게시일: 2026-06-10T06:08:21 UTC 최종 수정일: 2026-06-10T06:08:21 UTC 출처: Dahua 제품 보안 사고PSI 신뢰 센터 목차 요약 한눈에 보기 CVE-2026-29116과의 관계 취약점 타임라인 설명 기술 분석 영향받는 제품 CVSS 점수 취약점 점수 세부 정보 CWE 분류 공격 전제 조건 악용 시나리오 영...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC（概念実証） Redmine 3.2.9/3.3.9 までの SQL インジェクション https://nvd.nist.gov/vuln/detail/CVE-2019-18890 要件: アクセス資格情報 サブプロジェクトが必要 REST API が有効 MySQL では、インジェクションが発生する最初のクエリは以下の例のようになり、"-SLEEP5" がインジェクションされた部分です。 SELECT COUNT FROM INNER JOIN ON . = . INNER JOIN ON . = . WHERE...

PoC-CVE-2019-12840

Webmin 向け CVE-2019-12840 のエクスプロイト このリポジトリには、Webmin の脆弱性 CVE-2019-12840 を悪用する Python スクリプトが含まれています。 説明 スクリプトは Webmin サーバーにログインし、CVE-2019-12840 の脆弱性を悪用しようとします。スクリプトは、Webmin サーバーにログインするためのユーザー名とパスワード、サーバーの URL、サーバーのポート、リバースシェル用のローカルポート、サーバー上で実行するコマンドなど、いくつかのコマンドライン引数を受け付けます。 使用方法...

CVE-2026-84802

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo , which fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to ret...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE エクスプロイト CVE-2026-38751 概要 このPythonスクリプトは、CVE-2026-38751として識別されたOpenSTAManagerバージョン2.10のリモートコード実行の脆弱性を悪用します。このエクスプロイトにより、認証されたユーザーは悪意のあるモジュールをアップロードし、ターゲットシステム上で任意のコマンドを実行できます。 脆弱性詳細 CVE ID : CVE-2026-38751 製品 : OpenSTAManager バージョン : 2.10 タイプ : リモートコード実行 RCE 攻撃ベクトル :...

CVE-2024-23346

root@kitploit: /bin/python3.11 exploit.py -t -u -p -l...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload PHPコードの任意実行を引き起こす、複数の無制限ファイルアップロードがあります。 認証が必要な脆弱性のあるページ: localhost/officeadmin/?pid=54&action=add root@kitploit: -----------------------------181967832439954202373233921976 Content-Disposition: form-data; name="apid" 2...

CVE-2024-23346

CVE-2024-23346 このPoCは、William Khem-Marquez氏とMatthew Horton氏の報告・調査結果に基づいています： https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f 使用方法： python3 CVE-2024-23346.py -t targetURL -u username -p password -l localhost -P localport -X...

CVE-2018-7691

CVE-2018-7691 SSC REST API에는 인증된 사용자가 POST 메서드를 통해 로컬 및 LDAP 사용자의 임의 세부 정보를, GET 메서드를 통해 다른 사용자의 Fortify 프로젝트의 임의 세부 정보에 접근할 수 있도록 하는 안전하지 않은 직접 객체 참조IDOR 취약점이 포함되어 있습니다. Exploit-DB 게시: https://www.exploit-db.com/exploits/45990 PacketStorm 게시:...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE

Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps. id: CVE-2025-23211 info: name: Tandoor Recipes 1.5.24 - Jinja2 SSTI RCE author: sammiee5311 severity: critical description: | Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

WP Projects Portfolio <= 3.0 - Cross-Site Scripting

WP Projects Portfolio with Client Testimonials WordPress plugin = 3.0 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13114...