CVE-2026-56782-Gorse-Auth-Bypass

CVE-2026-56782 — Gorse 未认证数据库转储/恢复（认证绕过） Gorse 任何人均为管理员 if request.Header.Get"X-API-Key" == m.Config.Master.AdminAPIKey return true return false func m Master dumpresponse http.ResponseWriter, request http.Request if !m.checkAdminrequest writeErrorresponse, 401, "unauthorized"; return ... //...

derailed

derailed CVE-2021-40875: Improper Access Control in Gurock TestRail versions give it the url of the target without the md5 path https://foo.com Run dirsearch or your preferred fuzzing tool against the list. You'll noticed that a lot of the files a fairly standard in size 0B/15B or 25B/31B/32MB --...

CVE-2026-34220

CVE-2026-43220 Inyección SQL en MikroORM ★ PoC de Inyección SQL en MikroORM CVE-2026-43220 ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 Descripción general CVE-2026-43220 es una vulnerabilidad de Inyección SQL en MikroORM , un framework ORM para...

CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection

CVE-2024-41302-Bookea-tu-Mesa-es-vulnerable-a-inyección-SQL- Bookea-tu-Mesa es susceptible a una vulnerabilidad de inyección SQL SQLi. Esta falla permite a los atacantes inyectar comandos SQL maliciosos que pueden manipular la base de datos, comprometiendo potencialmente la integridad de los dato...

steamer

Steamer Import, manage, search public dumps. Do you have massive amounts of CSV, .sql, .txt, that have credentials, passwords, and hashes inside? Use Steamer to manage them! Load them into a MongoDB database, and either use the console directly, or just use the handy web interface complete with...

74cms - ajax_street.php 'x' SQL Injection

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. id: CVE-2020-22208 info: name: 74cms - ajaxstreet.php 'x' SQL Injection author: ritikchaddha severity: critical description: | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. impact: | Successful...

monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

PTP-RAT

PTP-RAT Exfiltra datos a través de interfaces de pantalla Puede encontrar más información sobre cómo funciona la herramienta en https://www.pentestpartners.com/security-blog/exfiltration-by-encoding-data-in-pixel-colour-values/...

CVE-2025-54726

CVE-2025-54726 JS Archive List = 5.0.12 time-based blind IF - comment Payload: cats=ifnow=sysdate,SLEEP5,0&exclus...

CVE-2026-89300

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-100751

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

CVE-2025-56819

CVE-2025-56819 Un problema en Datart v.1.0.0-rc.3 permite a un atacante remoto ejecutar código arbitrario mediante el parámetro de conexión INIT. POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type":...

joomla.3.7.0exploit

CVE-2017-8917 PoC de SQLi en Joomla Este repositorio contiene un proof of concept PoC simple y apto para CTF para la vulnerabilidad de inyección SQL comfields de Joomla CVE-2017-8917. El objetivo es mantener el flujo de trabajo ligero mientras se muestra el flujo completo de explotación: detecció...

R2SAE

R2SAE - React2Shell Auto-Exploit Una extensión de Firefox para detectar y explotar CVE-2025-55182 Vulnerabilidad de contaminación de prototipos en React Server Actions Características • Instalación • Uso • Aviso legal ⚠️ Aviso legal Esta herramienta es únicamente para pruebas de seguridad...

CVE-2026-100751

The Joomla Extension - regularlabs.com - Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 are vulnerable to Privileged stored XSS via data-rlta-url attributes. The component accepts a url option for an item and writes it to a generated attribute, which the browser subsequently passes to window.open...

EUVD-2026-88105

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

external_zlib_CVE-2022-37434

ZLIB DATA COMPRESSION LIBRARY zlib 1.2.8 is a general purpose data compression library. All the code is thread safe. The data format used by the zlib library is described by RFCs Request for Comments 1950 to 1952 in the files http://tools.ietf.org/html/rfc1950 zlib format, rfc1951 deflate format...

CVE-2026-84655

A flaw was found in Jenkins. When serializing objects as JSON and Python through its REST API, Jenkins does not properly escape map keys. This allows an attacker who can control map property names to inject arbitrary fields into JSON and Python API responses, potentially leading to information...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Inyección SQL sin autenticación 🧠 ID de CVE: CVE-2025-5287 Descubierto por: KhaledAlenazi Nxploited Publicado el: 27 de mayo de 2025 📋 Descripción El plugin Likes and Dislikes para WordPress es vulnerable a inyección SQL a través del parámetro post ...

CVE-2025-27893

CVE-2025-27893: Control Externo de Parámetro Web Asumido como Inmutable en Archer Platform Descripción En Archer Platform 6 hasta 6.14.00202.10024, un usuario autenticado con privilegios de creación de registros puede manipular campos inmutables, como la fecha de creación, interceptando y...