CVE-2020-23934

CVE-2020-23934 참조 1 https://www.exploit-db.com/exploits/48636 2 https://github.com/vj0shii/PRTG-Network-MonitorCMS-Authenticated-Remote-Code-Execution/blob/master/PRTGCMS.py 3 https://stackoverflow.com/questions/12385179/how-to-send-a-multipart-form-data-with-requests-in-python 4...

exploit-CVE-2015-8351

Gwolle Guestbook WordPress 플러그인 RFI 익스플로잇 이 Python 스크립트는 Gwolle Guestbook WordPress 플러그인의 치명적인 Remote File Inclusion RFI 취약점을 악용하며, 인증되지 않은 공격자가 원격 PHP 파일을 포함하고 취약한 시스템에서 임의 코드를 실행할 수 있습니다. 취약점 상세 정보 HTTP GET 매개변수 "abspath"가 PHP require 함수에서 사용되기 전에 적절히 정리되지 않습니다. 원격 공격자는 임의의 원격 서버에서...

CVE-2026-13257

The IBM DataPower Gateway is vulnerable to insufficient verification of data authenticity (CWE-345 ) in versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. This flaw could allow an authenticated user to forge signature requests . ...

CVE-2026-13257 IBM DataPower Gateway Insufficient Verification of Data Authenticity

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity...

CVE-2026-13258 IBM DataPower Gateway Cross-Site Scripting

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2026-14497 IBM DataPower Gateway Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures...

EUVD-2026-94997

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures...

CVE-2026-14497

The IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 , 10.6.1 through 10.6.6 , 10.6.0.0 through 10.6.0.10 , and 11.0.0.0 through 11.0.0.2 are vulnerable to a security bypass. A remote authenticated attacker can exploit improper verification of cryptographic signatures (CWE-347) to bypass...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE 説明 WonderCMS v3.2.0 - v3.4.2 は脆弱です。リモート攻撃者は、クロスサイトスクリプティング（XSS）エクスプロイトを使用してサーバーを完全に制御できます（教育目的のみ）。以下がその計画です: 動作の仕組み このエクスプロイトは、WonderCMSのinstallModuleコンポーネントを悪用して、任意のコードを実行するように細工されたスクリプトを忍び込ませます。 セットアップ ツール: exploit.py 必要なもの:...

CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-

CVE-2026-34156 – NocoBase サンドボックスエスケープ（RCE） -orange NocoBase バージョン ≤ 2.0.26 における、ワークフローサンドボックスエスケープを介した認証済みリモートコード実行 。 📋 説明 CVE-2026-34156 は、NocoBase ワークフローエンジンにおけるサンドボックスエスケープの脆弱性です。認証済みの攻撃者は、式サンドボックスをバイパスして基盤となるサーバー上で任意のシステムコマンドを実行する悪意のあるワークフローを作成できます。 攻撃ベクトル – NocoBase API への認証済み HTTP リクエスト...

CVE-2025-67730

CVE-2025-67730 – 保存型クロスサイトスクリプティング XSS 概要 CVE ID: CVE-2025-67730 脆弱性タイプ: 保存型クロスサイトスクリプティング XSS 深刻度: 中～高 状況依存 この脆弱性により、認証済みユーザーがJob 、Course 、Batch フォームの説明フィールド に悪意のあるHTMLおよびJavaScriptを注入できる可能性がありました。注入されたペイロードは、その後影響を受けたJob、Course、Batchを閲覧したすべてのユーザーのブラウザで自動的に実行されます。 影響を受けるコンポーネント Jobの説明フィールド...

cve-2025-2945-poc

pgAdmin4 쿼리 도구 인증 RCE PoC pgAdmin4 8.10 - 9.1 버전에서 pgAdmin4 쿼리 도구 인증 RCE 취약점CVE-2025-2945을 악용하는 독립 실행형 파이썬 스크립트입니다. Metasploit 모듈에서 포팅됨: pgadminquerytoolauthenticated.rb 참조: https://vulners.com/cve/CVE-2025-2945 https://nvd.nist.gov/vuln/detail/CVE-2025-2945...

CVE-2026-29115

CVE-2026-29115 — Dahua 인증 원격 서비스 거부 보고 유형: 공급업체 조정 보안 공개 CVE ID: CVE-2026-29115 공급업체: Dahua Technology 게시일: 2026-06-10T06:08:21 UTC 최종 수정일: 2026-06-10T06:08:21 UTC 출처: Dahua 제품 보안 사고PSI 신뢰 센터 목차 요약 한눈에 보기 CVE-2026-29116과의 관계 취약점 타임라인 설명 기술 분석 영향받는 제품 CVSS 점수 취약점 점수 세부 정보 CWE 분류 공격 전제 조건 악용 시나리오 영...

CVE-2025-25706

CVE-2025-25706 Description Item: Product Vendor: freebsdbrasil Item: ProApps - Enterprise Appliance Editor Creator: DreamWeaver PHP: PHP Version 7.3.18 Java Script Library: Jquery UI 1.6 | Jquery 1.2.6 Server: NGINX Operational System: FreeBDS Unix 취약점 유형: 원격 코드 실행 취약점 설명: 이 취약점은 사용자가 ping 기능을 통해...

CVE-2023-49471

CVE-2023-49471 脆弱性タイプ Blind SSRF 影響を受ける製品とバージョン Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0copyright" -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0sort" 1...

CVE-2020-10199_POC-EXP

影响版本 + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version + + EXP: python3 cve-2020-10199cmd.py http://127.0.0.1:8081 admin admin...

EUVD-2026-94984

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-15781

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to a stack-based buffer overflow (CWE-121). This flaw could allow a remote authenticated attacker to execute arbitrary code on the system. IBM...

CVE-2026-15781 IBM DataPower Gateway Buffer Overflow

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-94976

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...