CVE-2024-44541

CVE-2024-44541: SQL Injection Vulnerability in Inventio Lite v4 Description Inventio Lite v4 is vulnerable to SQL Injection SQLi in the /action=processlogin endpoint. This vulnerability allows attackers to inject arbitrary SQL queries via the username parameter in POST requests, potentially leadi...

CVE-2020-12112

CVE-2020-12112 🚨 BigBlueButton versions lower than 2.2.4 have a LFI vulnerability allowing access to sensitive files. Story 📜 During a distance learning course on a BigBlueButton instance a student in my class shared my teacher's slide presentation link and I noticed that the file name was includ...

CVE-2021-21017

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug : root@kitploit: IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl !=...

CVE-2022-37209

CVE-2022-37209 CVE-2022-37209 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

subgen

Subgen - una utilidad de concatenación de subdominios con algo de inteligencia Si has llegado a la conclusión de que te gustaría dividir tu metodología de enumeración DNS generando combinaciones y/o extrayendo datos pasivos de otras fuentes, entonces subgen es el clasificador y concatenador que...

CVE-2022-37204

CVE-2022-37204 PoC de CVE-2022-37204 Descripción sugerida RESERVED JFinal CMS 5.1.0 es vulnerable a Inyección SQL. Información adicional https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql7.md Tipo de vulnerabilidad Inyección SQL Vendedor del producto el grupo de...

XSS-Bypass-Filters

XSS-Bypass-Filters Redirection root@kitploit: document.location= document'location'= window.location= this"window""location"= document.location.href= location.href= location= window.location.assign window'location''href'= document.location.replace window.open"link", "blank"; Link root@kitploit:...

CVE-2022-37205

CVE-2022-37205 CVE-2022-37205 概念验证（POC） 建议描述 预留 JFinal CMS 5.1.0 存在 SQL 注入漏洞。这些 接口并未使用相同的组件，也不具备过滤器，而是各自采用自己的 SQL 拼接方式，导致 SQL 注入。 附加信息 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql8.md 漏洞类型 SQL 注入 产品供应商 开发团队 受影响产品代码库 https://github.com/jflyfox/jfinalcms - JFinal CM...

net-creds

从接口或pcap文件中彻底嗅探密码和哈希。会拼接碎片化的数据包，并且不依赖端口进行服务识别。 截图 --- 可嗅探内容 访问的URL 发送的POST负载 HTTP表单登录/密码 HTTP基础认证登录/密码 HTTP搜索 FTP登录/密码 IRC登录/密码 POP登录/密码 IMAP登录/密码 Telnet登录/密码 SMTP登录/密码 SNMP社区字符串 NTLMv1/v2 所有支持的协议：HTTP、SMB、LDAP等 Kerberos 示例 自动检测要嗅探的接口 sudo python net-creds.py 选择 eth0 作为接口 sudo python net-creds.py...

CVE-2022-37202

CVE-2022-37202 CVE-2022-37202 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 Affected Component These interfaces...

CVE-2022-37207

CVE-2022-37207 CVE-2022-37207 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection Additional Information...

CVE-2022-37206

CVE-2022-37206 CVE-2022-37206 POC Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql2.md Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0...

CVE-2022-37208

37208 CVE-2022-37208 建议描述 JFinal CMS 5.1.0 存在 SQL 注入漏洞。这些接口没有使用相同的组件，也没有过滤器，而是各自使用自己的 SQL 拼接方式，导致 SQL 注入。 附加信息 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql5.md 漏洞类型 SQL 注入 产品厂商 开发组 受影响产品代码库 https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 受影响组件...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC POC First of all you should install sqlmap you need set target domain or IP your cookie the run the shell root@kitploit: sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...

CVE-2022-37203

CVE-2022-37203 CVE-2022-37203 POC（概念验证） 附加信息 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql3.md 漏洞类型 SQL注入 产品供应商 开发团队 受影响的产品代码库 https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 受影响的组件 这些接口并未使用相同的组件，也没有过滤器，但各自使用了自己的SQL拼接方法，导致SQL注入 攻击类型 远程 影响代码执行 是 影响权限提升 是...

CVE-2026-48710

CVE-2026-48710 Principle: Starlette is an open-source, lightweight Python ASGI framework. The root cause is that when processing URL data structures, Starlette trusts the host sent by the client and directly concatenates it into the url variable for subsequent authentication handling. The raw URL...

CVE-2026-48490 ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino Stri...

CVE-2025-7769

CVE-2025-7769 – mobileapi 中的远程命令注入 描述： 本仓库包含针对 CVE-2025-7769 的概念验证（PoC）利用代码，该漏洞是 Tigo Energy CCA 设备在暴露 /cgi-bin/mobileapi 端点时存在的一个严重远程命令注入 漏洞。 该漏洞通过在 cmd JSON 键中注入操作系统命令触发，未经过滤的输入直接拼接到系统调用中，从而允许在设备上实现完全远程代码执行（RCE）。 参考： NVD 条目：https://nvd.nist.gov/vuln/detail/CVE-2025-7769 使用方法： root@kitploit: gcc...

CVE-2026-88055

AnythingLLM (by Mintplex-Labs), in versions 1.16.1 and earlier , is affected by a stored XSS caused by unescaped server-side HTML concatenation. The manager role can store meta_page_title or meta_page_favicon via /api/admin/system-preferences; these values pass unchanged through server/models/sys...