CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Avertissement : Cet outil est destiné à des fins éducatives et uniquement à des tests de pénétration autorisés. Utilisez-le uniquement contre des systèmes que vous possédez ou pour lesquels vous avez une autorisation écrite explicite. Toute utilisation non autorisée est...

SSCMS_Decrypt

sscms（siteserver cms） 데이터베이스 복호화 소개: SSCMS는 .NET Core 기반으로, 최소한의 비용과 적은 인력 투입으로 가장 짧은 시간 안에 기능이 완비되고 성능이 우수하며 규모가 크고 유지보수가 쉬운 웹사이트 플랫폼을 구축할 수 있습니다. 프로젝트 주소: https://github.com/siteserver/cms Des 복호화 root@kitploit: python3 sscmsdecrypt.py + Current Encrypt Data= 0NofLD4zWcY/jm+42NYzug== + secretKe...

CVE-2022-24716

CVE-2022-24716 Icinga Web 2 é um aplicativo de software que monitora sistemas de computador e redes. Ele possui uma interface web que permite aos usuários visualizar e gerenciar recursos do sistema. No entanto, há uma vulnerabilidade no Icinga Web 2 que permite que usuários não autenticados acess...

CVE-2023-23752-poc

영향을 받는 버전 4.0.0 = 4.2.8 Joomla 3 및 이하 버전은 이 취약점의 영향을 받지 않습니다. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true 이 API는 웹사이트의 가장 중요한 구성 정보데이터베이스 계정 및 비밀번호 포함를 가져오는 데 사용됩니다. http://127.0.0.1/Joomla/api/index.php/v1/users?public=true 웹사이트 사용자 이름 및 이메일 계정을 가져옵니다. 영향을 받는 기타 API는...

CVE-2023-23752-Docker

CVE-2023-23752 Vulnerabilità di accesso non autorizzato a Joomla CVE-2023-23752 in Docker Installazione Consigliato automatico 1. Clona questo repository git clone https://github.com/karthikuj/CVE-2023-23752-Docker.git 2. Entra nella directory cd CVE-2023-23752-Docker 3. Esegui ./setup.sh 4. Apri...

solarflare

solarflare Strumento di dumping delle credenziali per SolarWinds Orion Post sul blog: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Ringraziamenti a @asolino, @gentilkiwi e @skelsec per avermi aiutato a capire DPAPI. root@kitploit:...

CVE-2021-38295-PoC

CVE-2021-38295-PoC Una semplice proof of concept in Python per CVE-2021-38295. Post del blog correlato LINK AL BLOG Utilizzo: root@kitploit: Usage: cve-xxxx È sufficiente fornire allo script un host, un database a cui le tue credenziali hanno accesso, e la coppia nome utente/password. Se tutto...

DBconfigReader

Vulnerabilità di divulgazione delle informazioni di configurazione del database nell'interfaccia del sistema OA ecology di Weaver /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp Analisi del codice Fortify rileva - algoritmo di crittografia debole SecretKey key =...

Joomla-Scanner

Joomla Scanner Vulnerabilità di accesso non autorizzato a Joomla CVE-2023-23752 realizzato con python Visualizzazione dell'utilizzo Result.txt URL | Nome Database | Nome utente | Password | Host Dichiarazione di non responsabilità Questo strumento è solo per scopi educativi, è vietato venderlo o...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 ist eine quelloffene Überwachungs-Weboberfläche, ein Framework und eine Kommandozeilenschnittstelle. Nicht authentifizierte Benutzer können die Inhalte von benutzerzugänglichen lokalen Systemdateien des Webservers offenlegen, einschließlich...

CVE-2024-50961

Esposizione di Dati Sensibili CVE-2024-50961 Descrizione In DonWeb Ferozo Hosting v1.1, un attaccante remoto può sfruttare i parametri URL per accedere a dati sensibili, incluse le credenziali del database. I vettori d'attacco includono l'intercettazione di rete, i log del server e la cronologia...

solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. root@kitploit: ============================================...

CVE-2022-24716

CVE-2022-24716 Beliebige Datei-Offenlegungsschwachstelle in Icinga Web 2 2.8.6, 2.9.6, 2.10 Icinga Web 2 ist eine Open-Source-Überwachungs-Weboberfläche, ein Framework und eine Befehlszeilenschnittstelle. Nicht authentifizierte Benutzer können den Inhalt von Dateien des lokalen Systems einsehen,...

HTB-Devvortex-CVE-2023-2375-PoC

جوملا! CVE-2023-23752 - إثبات المفهوم لكشف معلومات غير مصادق عليه الوصف يحتوي هذا المستودع على إثبات المفهوم PoC لاستغلال CVE-2023-23752، وهي ثغرة في جوملا! تسمح بكشف معلومات بدون مصادقة. يمكن لهذه الثغرة كشف معلومات حساسة، بما في ذلك بيانات اعتماد قاعدة البيانات وملفات التكوين وغيرها، للمستخدمين...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

PT-2026-70796

Name of the Vulnerable Software and Affected Versions ishankportfolio versions prior to 1.0.1 Description Contact form submissions may be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database...

CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

GHSA-957R-QF9P-67XW Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...