GHSA-C24V-8RFC-W8VW Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

coralconcept.in Improper Access Control vulnerability OBB-3836888

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Improper Input Validation in Kubernetes Ingress-Nginx

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...

Exploit for Injection in Atlassian Confluence_Data_Center

CVE-2023-22527 Confluence RCE CVE-2023-22527 - RCE Remote Co...

CVE-2019-8212

creationtimestamp| type| source ---|---|--- 2024-01-16 20:15:54+00:00| published-proof-of-concept| https://t.me/ctinow/168976...

CVE-2023-51000

creationtimestamp| type| source ---|---|--- 2024-01-15 11:56:27+00:00| published-proof-of-concept| https://t.me/CNArsenal/1845 2024-01-15 12:10:12+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9789 2024-08-16 09:09:01+00:00| published-proof-of-concept|...

CVE-2024-23199

creationtimestamp| type| source ---|---|--- 2024-01-14 22:00:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6421...

CVE-2024-23200

creationtimestamp| type| source ---|---|--- 2024-01-14 21:48:31+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6420...

CVE-2023-6690

creationtimestamp| type| source ---|---|--- 2024-01-14 16:11:05+00:00| published-proof-of-concept| https://t.me/ctinow/168069...

Exploit for CVE-2024-24138

CVE-2024-24138: Online Timesheet App SQL Injec...

Exploit for CVE-2024-24137

CVE-2024-24137: Student File Managment System SQ...

Exploit for Cross-site Scripting in Remyandrade Math_Game

CVE-2024-24136 : Math Game Cross-Site-Scripti...

CVE-2023-31036

creationtimestamp| type| source ---|---|--- 2024-01-12 18:52:06+00:00| seen| https://t.me/ctinow/167437 2024-02-02 21:46:50+00:00| seen| https://t.me/ctinow/178283 2024-05-17 14:18:43+00:00| published-proof-of-concept|...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This co...

Exploit for Cross-site Scripting in Remyandrade Online_Food_Menu

CVE-2024-24134 : Online Food Menu - Cross-Site...

Exploit for Files or Directories Accessible to External Parties in Apache Struts

CVE-2023-50164 Apache Struts path traversal to RCE vulnerabil...

CVE-2023-36003

creationtimestamp| type| source ---|---|--- 2024-01-12 06:34:42+00:00| published-proof-of-concept| https://t.me/RalfHackerChannel/1435 2024-01-12 07:52:16+00:00| published-proof-of-concept| Telegram/1674BjUB8N4Vh5UgM4C683OiwC85nxwmrNkvE4vdI1bn-w 2024-01-12 11:17:11+00:00|...

Exploit for CVE-2024-22890

CVE-2024-22890: My e-Diary App - Cross-Site-Scr...

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

Summary Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. Details The Home Preference page exposes a list of system settings such as Run Mode, Jwt Secret, Node Secret and Terminal Start Command. The...

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Summary The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sendi...