EUVD-2026-89428

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

Carnivore

由 NCC Group Plc 以开源形式发布 - https://www.nccgroup.com/ 由 Chris Nevin 开发，[email protected] https://www.github.com/nccgroup/carnivore 根据 AGPL 许可证发布 https://www.github.com/nccgroup/carnivore/license Carnivore - V.1.0.4 微软外部评估工具 概述： Carnivore 是一个针对 Skype for Business、Exchange、ADFS 和 RDWeb 服务器以及部分...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle acaba de revelar una nueva vulnerabilidad CVE-2025-61884, el script de detección para esa vulnerabilidad se puede encontrar en este repositorio o originalmente aquí:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. Tal como se cita en e...

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 Generador de artefactos de detección para Oracle E-Business Suite CVE-2025-61882 Consulte nuestra publicación en el blog para obtener detalles técnicos Detección en acción python3 watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882.py --command...

Awesome-BEC

Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

trappsec

trappsec trappsec 是一个开源框架，帮助开发者检测探测 API 业务逻辑的攻击者。通过嵌入难以与真实 API 结构区分的逼真假路由和蜜罐字段，诱使攻击者进行身份认证——将侦察行为转化为可操作的安全遥测数据。 专为那 1% 实际查看安全告警的人，以及 99% 仅仅喜欢拥有告警这个想法的人而构建。 阅读文档 • 极速入门 核心概念 Decoy Routes（假路由）： 这些是位于真实业务逻辑之外但看起来真实的“幽灵”端点。通过在客户端代码中植入虚假引用，可以引诱攻击者触碰这些陷阱，从而通过自定义静态或动态响应（根据认证状态调整）监控其行为。 Honey Fields（蜜罐字段...

CVE-2025-61882-Oracle-EBS

Oracle E-Business Suite — CVE-2025-61882 Este repositorio contiene los artefactos de investigación de ZeroZenX y una implementación de exploit totalmente operativa para CVE-2025-61882, proporcionados para respaldar la investigación defensiva, la respuesta a incidentes, la ingeniería de detección ...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Prueba de Concepto PoC Simplemente accede a la URL con tu código PHP en el parámetro "gridValoresPopHidden"...

CVE-2026-46817

🚨 CVE-2026-46817 - 关键远程代码执行 Oracle E-Business Suite – Oracle Payments（文件传输） 影响Oracle Payments（文件传输）的关键未认证远程漏洞，可能通过HTTP完全攻破该应用。 📌 概述 CVE-2026-46817 是 Oracle E-Business Suite 中 Oracle Payments 组件的一个 关键 漏洞。该缺陷影响 文件传输 功能，可通过 HTTP 远程利用，无需认证 。 成功利用后，攻击者可完全攻破易受攻击的 Oracle Payments 应用，导致以下全部损失： 🔓 保密性 ✏️ 完整...

CVE-2020-6308

CVE-2020-6308 Script de explotación para el SSRF de SAP Business Objects Este es un sencillo script en Golang para automatizar la explotación de CVE-2020-6308. El repositorio original de Github no mostraba ninguna automatización https://github.com/InitRoot/CVE-2020-6308-PoC , gracias a @InitRoot,...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2024-30896

CVE-2024-30896 Resumen Una falla de lógica de negocio en influxdb permite a los usuarios que poseen un token allAccess válido escalar sus privilegios al nivel de operador al listar los tokens de autorización actuales. Escenario El atacante podría ser un usuario al que un administrador le otorgó...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

msprobe

msprobe 关于 安装 使用方法 示例 即将推出 致谢 关于 发现所有本地部署的微软产品，用于密码喷洒和枚举。 该工具将使用与目标根域名相关的常见子域名列表，尝试发现有效的本地部署微软解决方案实例。以下是工具运行时的截图： 安装 使用 pipx 安装该项目 pipx install git+https://github.com/puzzlepeaches/msprobe.git 使用方法 该工具包含四个不同的模块，用于协助发现本地部署的微软产品： Exchange RD Web ADFS Skype for Business 帮助菜单和支持的模块如下所示： Usage: msprob...

CVE-2025-53072-CVE-2025-62481

CVE-2025-53072 & CVE-2025-62481 Vulnerabilidad en el producto Oracle Marketing de Oracle E-Business Suite componente: Marketing Administration. ¿Cómo funciona este método de detección? Esta plantilla de Nuclei detecta instancias de Oracle E-Business Suite vulnerables a CVE-2025-53072 y...

PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. id: CVE-2023-4115 info: name: PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting author:...

Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting

Dyn Business Panel WordPress plugin = 1.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter in output, letting attackers execute scripts in the context of high privilege users, exploit requires victim to click a malicious link. id: CVE-2024-130...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...

Business Directory Plugin <= 6.4.2 - SQL Injection

The Business Directory Plugin Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...