CVE-Vulnerability-Information-Downloader

CVE Vulnerability Information Downloader Common Vulnerability Scoring System CVSS is a free and open industry standard for assessing the severity of computer system security vulnerabilities. Exploit Prediction Scoring System EPSS estimates the likelihood that a software vulnerability will be...

vPrioritizer

Overview | How it works | Quickstart | Roadmap | Contact Me Overview As indicated by sources like vulndb & cve, on a daily basis, approximately 50 new vulnerabilities become known to industry and it’s safe to assume that count is going to increase furthermore. It’s a huge number of vulnerabilitie...

zabbix-threat-control

Zabbix Threat Control ztc Turn the Zabbix you already run into a vulnerability-management console. ztc reads each host's software inventory through the stock zabbix-agent2 no extra agent to deploy, audits it against Vulners, and pushes scored, per-host findings — problems, dashboards and CVSS...

CVE-2025-31131

CVE-2025-31131 - YesWiki 4.5.2 路径遍历利用 这是一个针对 YesWiki 4.5.2 之前版本的未授权路径遍历利用工具。漏洞存在于 squelette 参数中，允许从服务器读取任意文件。 漏洞详情 CVE-ID: CVE-2025-31131 受影响软件: YesWiki 4.5.2 类型: 路径遍历 严重性: 高危 CVSS: 8.6 参考: https://github.com/advisories/GHSA-w34w-fvp3-68xm 使用方法 python3 exploit.py -l urls.txt 以下是通过 Burp 手动利用的第二种方法...

CVE-2021-44228-PoC

自包含实验室环境 PoC，利用 Log4Shell CVE-2021-44228 运行反向 Shell 这是一个自包含的实验室环境，可通过 docker compose 安全地运行该漏洞。 受影响版本为 Apache Log4j =2.0–2.14.1，CVE 编号为 CVE-2021-44228 （CVSS 评分：10.0）。 请尽快将 Apache Log4j 升级到 2.16+ 版本 !!! 前提条件 此代码需要 Docker 和 Docker Compose。 描述 Dockerfile 和 docker-compose.yml 文件是不言自明的，用于构建和启动实验室环境。...

CVE-2023-22515-POC

CVE-2023-22515 CVE-2023-22515, una vulnerabilidad crítica que afecta a las instancias locales de Confluence Server y Confluence Data Center, una vulnerabilidad de control de acceso roto. Attlassian ha proporcionado una puntuación base CVSS de 10.0 Exploit Breve explicación: 1- Debido a cómo los...

exploit-react-CVE-2025-55182

FOX-RSC 工具 CVE-2025-55182 和 CVE-2025-66478 法律免责声明 中文： 此工具是概念验证（PoC），仅用于安全研究和教育目的。未经明确许可在系统上使用此工具是违法的，并可能受到法律制裁。作者（Tiger-Foxx）不对滥用行为承担任何责任。 法语： 此工具是概念验证（PoC），仅用于安全研究和教育目的。未经明确许可在系统上使用此工具是违法的。 描述 Fox-RSC 工具 是一款专用浏览器扩展和工具包，旨在检测和演示影响 React 服务器组件（RSC）的关键漏洞 CVE-2025-55182（React2Shell） 。...

log4shell-mitigation

Log4j2 RCE漏洞详情与缓解策略 访问此 YouTube 视频获取更多详情。 https://youtu.be/jqWdwTeGRK0 这是一篇关于 CVE-2021-44228 安全漏洞（又名 Log4Shell 和 LogJam）在 log4j2 中的缓解措施的快速文章。 免责声明 所有信息及随附的代码示例仅供教育及参考之用，仅适用于您自己的系统。 请谨慎操作，风险自负。 这是什么 这是一个零日漏洞，以远程代码执行（RCE）的形式存在于特定版本的流行 Java 日志框架 log4j2 中。 严重程度如何 它在通用漏洞评分系统（CVSS）中的评分为 10 分（满分 10 分）。...

DSpace__DSpace_CVE-2022-31194_5-10

La información de la versión de DSpace se puede ver en línea en https://wiki.duraspace.org/display/DSDOC/ La documentación de las versiónes estables más recientes se puede descargar o ver en línea en http://www.dspace.org/latest-release/ https://wiki.duraspace.org/display/DSDOC/...

freevulnsearch

freevulnsearch This NMAP NSE script is part of the Free OCSAF project - https://freecybersecurity.org. In conjunction with the version scan "-sV" in NMAP, the corresponding vulnerabilities are automatically assigned using CVE Common Vulnerabilities and Exposures and the severity of the...

CVE_Prioritizer

CVE Prioritizer CVE Prioritizer is a powerful tool that helps you prioritize vulnerability patching by combining CVSS, EPSS, CISA's Known Exploited Vulnerabilities and VulnCheck's community resources NVD++, KEV. It provides valuable insights into the likelihood of exploitation and the potential...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Essential Blocks < 4.4.3 - Local File Inclusion

Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site. id: CVE-2023-6623 info: name: Essential Blocks 4.4.3 - Local File...

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

Movies <= 0.6 - Cross-Site Scripting

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...

WordPress EasyCart <2.0.6 - Information Disclosure

WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. id: CVE-2014-4942 info: name: WordPress EasyCart 2.0.6 - Information Disclosur...