CVE-2026-97878 zhistaredu StarTraining Druid Console index.html anonymous missing authentication

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-97878

A vulnerability exists in zhistaredu StarTraining up to version 3.8.1 within the Druid Console component. Specifically, the anonymous function of the file /druid/index.html is affected. This flaw allows for missing authentication , enabling an attacker to perform the attack remotely . An exploit ...

MAL-012

MAL-012: Cross-Site Scripting Reflejado en la Consola de Administración que conduce a Ejecución Remota de Código en Payara Server Se encontró un ataque de Cross-Site Scripting XSS reflejado en la Consola de Administración de Payara. Al convencer a un usuario administrador de que acceda a la URL...

woodpecker-plugins

woodpecker-plugins usage Copie el plugin en el directorio woodpecker-framwork/plugin y ejecute java -jar woodpecker-framework.1.3.3.jar de https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: echo 't3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'|nc 10.20.31.1...

CVE-2023-33732

CVE-2023-33732 — Cross-Site Scripting Reflejado en la Consola de Administración de eScan -orange Resumen CVE-2023-33732 es una vulnerabilidad de Cross-Site Scripting XSS Reflejado descubierta en la Consola de Administración de eScan de Microworld Technologies , versión 14.0.1400.2281. El fallo...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Cross-Site Scripting reflejado XSS Tabla de contenidos Descripción general Detalles de la vulnerabilidad Producto afectado Análisis técnico Prueba de concepto Pasos para reproducir Impacto Mitigación y remediación Referencias Descargo de responsabilidad...

CVE-2023-33731

CVE-2023-33731 — eScan 管理控制台：反射型跨站脚本（XSS） -orange 目录 概述 漏洞详情 严重程度与 CVSS 评分 受影响产品 技术分析 概念验证 影响 缓解与修复措施 披露时间线 参考资料 作者 概述 在 Microworld Technologies 开发的 eScan 管理控制台 （版本 14.0.1400.2281）中发现了一个 反射型跨站脚本（XSS） 漏洞。该漏洞存在于 仪表盘详情 （DashBoardDetails）端点，其中多个查询字符串参数被直接反射到 HTML 响应中，未经适当的净化或输出编码。未认证的远程攻击者可以构造恶意...

CVE-2023-33730

CVE-2023-33730 — Escalada de Privilegios en eScan Management Console Severidad: Crítica ID CVE: CVE-2023-33730 Divulgado: 30 de mayo de 2023 Autor: Sahil Ojha Tabla de Contenidos Overview Vulnerability Details Impact Technical Analysis Proof of Concept Remediation References Disclaimer Descripció...

wordpress-exploit-framework

WordPress 漏洞利用框架 一个旨在协助对 WordPress 系统进行渗透测试的 Ruby 框架。 安装 要安装最新的稳定版本，请运行 gem install wpxf。 安装后，您可以通过运行 wpxf 启动 WordPress 漏洞利用框架控制台。 运行需要什么？ 运行 WordPress 漏洞利用框架需要 Ruby = 2.4.4。 安装故障排除 Debian 系统 如果在安装 WPXF 依赖项（特别是 Nokogiri）时遇到问题，请首先确保已安装编译 C 扩展所需的所有工具： sudo apt-get install build-essential patch...

msf-remote-console

Not mantained This tool won't be mantained by me anymore. There are better alternatives from Rapid7 themselves as descrived here: How to run metasploit remotley Example: To make msf commands viable from elsewhere then the metasploit-framework directory set the GEMHOME variable. To find the...

endgame

ENDGAME C2 FRAMEWORK ENDGAME es un framework profesional de comando y control construido para compromisos autorizados de red team, pruebas de penetración e investigación educativa en seguridad. Diseñado para simular técnicas realistas de adversarios, evaluar la cobertura de detección y ayudar a l...

H2 Database Console - JNDI Injection RCE

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution via the H2 web console versions before...

MinIO Cluster Deployment - Information Disclosure

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD. An attacker can potentially obtain sensitive...

Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. id: CVE-2019-7276 info: name: Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console author: daffainfo severity: critical description: | Optergy Proton/Enterprise devices allow Remote Root Cod...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Cross-Site Scripting XSS reflejado Resumen CVE-2023-34837 es una vulnerabilidad de Cross-Site Scripting XSS reflejado descubierta en Microworld Technologies eScan Management Console versión 14.0.1400.2281. La vulnerabilidad existe en el parámetro POST...

EXOS < 31.7.4 / 32.0.0 < 32.7.4.15 / 33.0.0 < 33.1.100, 33.7.0 < 33.7.1 Privilege Escalation (SA-2026-088)

The version of EXOS installed on the remote host is missing a security update. It is, therefore, affected by an privilege escalation vulnerability. - ExtremeXOS shell environment utilities fail to safely canonicalize paths and can follow symbolic links from a writable user directory to a privileg...

CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Reflected Cross-Site Scripting XSS Overview CVE ID: CVE-2023-34836 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium...

mimikatz-detector-condrv

Mimikatz Detector - ConDrv + ConsoleMonitor This project is based on the research that was done for mimikatz detection technique phase 2. It has multiple projects in the solution: ConsoleMonitor - A GUI application in C to sniff console related traffic input output through ConDrv...

thetick

The Tick A simple embedded Linux backdoor. The Tick Compiling Installing Usage Media Compiling The Tick depends only on libcurl, so make sure you have the corresponding development package. For example on Debian based distributions you would do the following: sudo apt-get install libcurl-dev Once...

CVE-2023-34838

CVE-2023-34838 — XSS Almacenada en eScan Management Console Resumen Microworld Technologies eScan Management Console versión 14.0.1400.2281 es vulnerable a un ataque de Cross-Site Scripting XSS Almacenado. Un atacante autenticado con acceso a la función de gestión de roles puede inyectar un scrip...