46 matches found
CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard
CVE-2025-34227 Nagios XI Configuration Wizard における認証済みコマンドインジェクション CVE-2025-34227 の簡単な概念実証リポジトリです。Nagios XI の Configuration Wizard における認証済みコマンドインジェクションです。 詳細な解説はこちら: https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ curl 概念実証 以下のペイロードは database パラメータに含まれています: ;touch...
CVE-2014-4688-pfsense
CVE-2014-4688 – pfSense 명령 주입 CVE-2014-4688pfSense statusrrdgraphimg.php 명령 주입용 수정된 Exploit-DB 개념 증명 개요 이 저장소는 pfSense 버전 ≤ 2.1.3에 영향을 미치는 CVE-2014-4688 용 원본 Exploit-DB 개념 증명의 수정 버전을 포함합니다. 이 취약점은 statusrrdgraphimg.php 구성 요소에 존재하며, database 매개변수의 부적절한 입력값 검증으로 인해 인증된 사용자가 임의의 시스템 명령을 실행할 수 있게 합니다...
CVE-2025-50196
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST maindatabase parameter. This issue has been patched in version 1.11.30...
CVE-2025-50196 Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST maindatabase parameter. This issue has been patched in version 1.11.30...
CVE-2025-50196 Chamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameter
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST maindatabase parameter. This issue has been patched in version 1.11.30...
CVE-2025-50196
Chamilo LMS prior to 1.11.30 is affected by an issue in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. The vulnerability allowed exploitation that could lead to arbitrary SQL queries being executed. It is patched in version 1.11.30; update to 1.11.30 or later to rem...
📄 Nagios XI Monitoring Wizard Command Injection
Nagios XI is a widely used enterprise monitoring solution. A vulnerability exists within the Monitoring Wizard configuration page where the database parameter is unsafely passed into backend operations. Authenticated users can exploit this to execute arbitrary system commands, allowing full remot...
Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered
Summary Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records Details After wings sends activity logs to the panel it deletes the processed activity entries from t...
CVE-2023-53938
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
CVE-2023-53938
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
CVE-2023-53938 RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
CVE-2023-53938 RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
CVE-2023-53938 RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
CVE-2023-53938
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability exploitable via multiple unencoded input parameters (database, collection, login). The root cause is input parameters not being encoded before rendering, enabling attackers to inject arbitrary JavaScript into a victim’s browser....
CVE-2023-53938: Improper Neutralization of Input During Web Page Generation
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute...
Deserialization Of Untrusted Data
h2o is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper handling of JDBC connection parameters with insufficient input validation, which allows an attacker to bypass regular expression checks using double URL encoding and subsequently read arbitrary files or...
EUVD-2007-2800
Malware in sbrugna...
EUVD-2004-0664
Malware in sbrugna...