CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - SQL-Injection nach Authentifizierung Exploit-Titel: WooCommerce Customers Manager 29.4 - SQL-Injection nach Authentifizierung Datum: 2024-03-25 Autor des Exploits: Ivan Spiridonov - xbz0n Software-Link:...

CVE-2026-16177 IBM DataPower Gateway Out-of-bounds Read

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

EUVD-2026-94890

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-16177

The IBM DataPower Gateway is vulnerable to an out-of-bounds read (CWE-125 ) which could allow a remote authenticated attacker to obtain sensitive information. Affected versions include 10.5.0.0 through 10.5.0.22 , 10.6.1 through 10.6.6 , 10.6.0.0 through 10.6.0.10 , and 11.0.0.0 through 11.0.0.2 ...

CVE-2023-46404

CVE-2023-46404 PCRS é uma aplicação web para exercícios de programação online desenvolvida na Universidade de Toronto. Veja o repositório Bitbucket: https://bitbucket.org/utmandrew/pcrs/src/3.11/ Resumo A página “Questions” do PCRS, com submissão de código, e a página “Code editor” são vulnerávei...

CVE-2024-51031

CVE-2024-51031 Beschreibung Eine Cross-Site-Scripting XSS-Sicherheitslücke in manageaccount.php in Sourcecodester Cab Management System 1.0 erlaubt es remote authentifizierten Benutzern, beliebige Webskripte über die Felder „First Name“, „Middle Name“ und „Last Name“ einzuschleusen...

CVE-2024-48427

CVE-2024-48427 Beschreibung Eine SQL-Injection-Schwachstelle im Sourcecodester Packers and Movers Management System v1.0 ermöglicht es entfernten authentifizierten Benutzern, beliebige SQL-Befehle über den id-Parameter in /mpms/admin/?page=services/manageservice&id auszuführen. Art der...

CVE-2020-24028

CVE-2020-24028 Descrição ForLogic Qualiex v1 e v3 permite que qualquer cliente autenticado realize escalonamento de privilégios através de criações de usuário, alterações de senha ou atualizações de permissões de usuário. Datas Importantes Anúncio para o fornecedor: 2020-07-12 Data de divulgação...

CVE-2025-65345

CVE-2025-65345 – Path Traversal Autenticado na Função Zip que Leva à Divulgação do Sistema de Arquivos no laravel-file-manager v3.3.1 🧭 Visão Geral Uma vulnerabilidade de Directory Traversal autenticada no laravel-file-manager v3.3.1 e anteriores permite que atacantes com acesso à interface do...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - Authentifizierte RCE Dieses PoC-Skript basiert auf dem Exploit von Fellipe Oliveira. Funktionen : Lädt C-Code direkt nach /hardware hoch anstatt eines .st-Datei-Uploads Stellt das Standardprogramm vor dem Hochladen der Reverse Shell wieder her Verbesserte...

CVE-2025-57055

CVE-2025-57055: Authentifizierte Remote-Code-Ausführung in WonderCMS 3.5.0 Angriffsmechanik In WonderCMS v3.5.0 existiert eine authentifizierte Remote-Code-Ausführungs-Schwachstelle RCE. Das Problem liegt in der Art und Weise, wie die Anwendung Remote-Theme/Modul-Installationen über...

CVE-2025-47987

CVE-2025-47987: Windows CredSSP Elevation of Privilege 📌 Este repositório contém documentação e recursos de análise sobre a vulnerabilidade CVE-2025-47987, uma falha de estouro de buffer na região heap Heap-based Buffer Overflow que afeta o protocolo Windows Credential Security Support Provider...

CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi Sou @abraxasnull. Laboratório loopback. O cliente é CVE-2026-22599-Abraxas-Labs.py. Injeção de consulta ao banco de dados na API de escrita do Content-Type Builder...

CVE-2023-40028

CVE-2023-40028: Exploração de Symlink no Ghost CMS PoC Visão Geral Este repositório contém um script de Prova de Conceito PoC projetado para demonstrar a exploração da CVE-2023-40028 , uma vulnerabilidade de Inclusão Local de Arquivos LFI que afeta versões do Ghost CMS anteriores à 5.59.1. A...

CVE-2026-107573

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2023-40028

Proof of Concept PoC für CVE-2023-40028 CVE-2023-40028 ist eine Schwachstelle in Ghost CMS, die durch unsachgemäße Dateiverarbeitung das beliebige Lesen von Dateien ermöglicht. Dieses PoC demonstriert, wie der Exploit unter kontrollierten Bedingungen funktioniert. Nur für Bildungszwecke. Referenz...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE no WordPress WordPress 5.6-5.7 - XXE autenticado Autor+ CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Como usar Passo 1. Executar o WordPress $ make up-wp Passo 2. Executar o servidor web do atacante $ make up-mal Passo 3. Gerar arquivo WAV malicioso Com o wavefil...

CVE-2023-40931-PoC

CVE-2023-40931 O payload sqlmap para explorar o CVE-2023-40931 Payload Informações necessárias: Nome de usuário e senha válidos Domínio e caminho da instância hospedada sqlmap -D nagiosxi -T xiusers -u...

exploit-CVE-2019-14530

OpenEMR CVE-2019-14530 Exploit OpenEMR --debug exploit.rb -h | --help Optionen: Basis-URL Basis-Pfad inklusive HTTP-Schema, Port und Basis-Ordner Dateiname der auszulesenden Datei Benutzername des Administrators Passwort des Administrators --debug Argumente anzeigen -h, --help Diesen Bildschirm...

POC_CVE-2025-14700

CVE-2025-14700 PoC für CVE-2025-14700 , eine Server-Side Template Injection SSTI-Schwachstelle in Crafty Controller = 4.6.1. Diese Schwachstelle ermöglicht es authentifizierten Benutzern, durch das Einschleusen bösartiger Jinja2-Vorlagen in die Webhook-Konfiguration Remote-Codeausführung RCE zu...