CVE-2020-11107

CVE-2020-11107 Dies ist ein Writeup für CVE-2020-11107, das ich gefunden habe. Ein Problem wurde in XAMPP vor Version 7.2.29, 7.3.x vor 7.3.16 und 7.4.x vor 7.4.4 unter Windows entdeckt. Ein unprivilegierter Benutzer kann eine .exe-Konfiguration in xampp-contol.ini für alle Benutzer einschließlic...

CVE-2025-21293

CVE-2025-21293 CVE-2025-21293 è una vulnerabilità di elevazione dei privilegi in Active Directory Domain Services. Consente agli "Operatori di configurazione di rete" di eseguire codice con privilegi SYSTEM tramite Windows Performance Counters. Le versioni di Windows interessate includono Windows...

WAGO-CVE-2023-1698

WAGO-CVE-2023-1698 WAGO-System-Ferncodeausführungs-Schwachstelle CVE-2023-1698 Hinweis Ich habe ein Tool für lokale Tests und POC-Entwicklung entwickelt, das nur als technische Lernreferenz dient. Bitte verwenden Sie es nicht für illegale Zwecke. Direkte oder indirekte Konsequenzen und Verluste,...

cve-2022-22965

Spring4Shell - CVE-2022-22965 Compilazione cloniamo il repository, compiliamo e avviamo il contenitore root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22965.git $ cd cve-2022-22965 $ docker build . -t spring4shell-poc $ docker run -p 8080:8080 --name spring4shell-poc...

CVE-2025-31651-o

CVE-2025-31651 Für eine Teilmenge von unwahrscheinlichen Rewrite-Regel-Konfigurationen war es möglich, dass eine speziell gestaltete Anfrage einige Rewrite-Regeln umgehen konnte. Wenn diese Rewrite-Regeln effektiv Sicherheitsbeschränkungen durchsetzten, konnten diese Beschränkungen umgangen werde...

kcfg-bypass

kcfg-bypass Esempio di bypass kcfg - CVE-2024-21338...

GLPwn

GLPwn Ein GLPI-Hack-Tool, das Apache Directory Listing und/oder CVE-2020-15175 nutzt, um Dateien und gültige Sitzungen auszulesen. Wer ist verwundbar? Jede GLPI-Instanz, bei der das Apache Directory Listing im /files-Ordner bereits aktiviert ist Alle GLPI-Instanzen vor 9.5.1, die auf einem...

CVE-2023-27216

CVE-2023-27216 - Router DLink Questo documento è la mia esperienza personale in qualità di principiante nel reversing e nello sfruttamento di firmware. Scopo A scopo dimostrativo, analizzeremo e riprodurremo CVE-2023-27216. Numero CVE: CVE-2023-27216 Descrizione della vulnerabilità: Un problema...

CVE-2021-30357_CheckPoint_SNX_VPN_PoC

CVE-2021-30357CheckPointSNXVPNPoC Proof-of-Concept für privilegiertes Dateilesen über den CheckPoint SNX VPN Linux Client. Betroffene Version CheckPointVPNSNXLinux800007075.sh MD5-Prüfsumme: 4372e9936e2dfb1d1ebcef3ed4dd7787 Exploit Um den Exploit auszuführen, laden Sie einfach eine beliebige Date...

wazuh-nginx-cve-2026-42945-sca-lab

CVE-2026-42945 — Laboratorio Difensivo NGINX Wazuh SCA Panoramica Questo repository documenta un laboratorio difensivo per CVE-2026-42945 , che interessa il modulo NGINX ngxhttprewritemodule. L'obiettivo di questo progetto era affrontare la CVE da una prospettiva blue team utilizzando Wazuh...

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter. id: CVE-2021-39316 info: name: WordPress DZS Zoomsounds =6.51 to fix t...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...

Cisco RV132W/RV134W Router - Information Disclosure

Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information. id: CVE-2018-012...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Apache Kylin - Exposed Configuration File

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without...

Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

SolarView Compact 6.00 - Local File Inclusion

SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. id: CVE-2022-29298 info: name: SolarView Compact 6.00 - Local File Inclusion author: ritikchaddha severity: high description: SolarView Compact 6.00 is vulnerable to local file...