twitter-intelligence

Twitter Intelligence Un progetto scritto in Python per il tracciamento e l'analisi di Twitter senza utilizzare l'API di Twitter. Prerequisiti Questo progetto è un'applicazione Python 3.x. Le dipendenze dei pacchetti sono nel file requirements.txt. Esegui quel comando per installare le dipendenze...

CVE-2024-10140

CVE-2024-10140 Lo script sfrutta una vulnerabilità di SQL Injection presente nell'endpoint /php/managesupplier.php?action=delete&id=32. La vulnerabilità consente a un attaccante di iniettare comandi SQL arbitrari tramite il parametro id, compromettendo potenzialmente il database ed esponendo...

CVE-2020-9483

CVE-2020-9483 PoC della vulnerabilità di SQL InjectionCVE-2020-9483,Apache SkyWalking Uso:python3 CVE-2020-9483.py -ip 127.0.0.1 Puoi usare questo script per ottenere la versione del database tramite SQL Injection Clicca sulla stella se ti piace questo script Se pensi che questo PoC ti abbia...

CVE-2021-42392-exploit-lab

⚠️ PoC dell'Exploit RCE del Database H2 CVE-2021-42392 Questo repository fornisce un ambiente minimale e controllato per testare la vulnerabilità di esecuzione remota di codice del database H2 CVE-2021-42392 utilizzando la funzionalità CREATE ALIAS. A differenza di molte dimostrazioni, questo...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...

whatportis

whatportis .. image:: https://github.com/opencve/opencve/workflows/Tests/badge.svg :target: https://github.com/ncrocfer/whatportis/actions/workflows/tests.yml .. image:: https://badge.fury.io/py/whatportis.svg :target: https://pypi.python.org/pypi/whatportis/ .. image::...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL-Injection-Schwachstelle im Drupal Core Hochwirksame SQL-Injection-Schwachstelle im Drupal Core PostgreSQL 📋 Übersicht CVE-2026-9082 ist eine SQL-Injection -Schwachstelle in der Datenbank-Abstraktionsschicht von Drupal Core. Sie betrifft nur Websites, die PostgreSQL als...

CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept Breve programma che dimostra la vulnerabilità CVE-2024-33901 in KeePassXC versione 2.7.7 La relazione per il corso potrebbe richiedere il collegamento al codice sorgente, perciò ho creato la repository per questo Come replicare la vulnerabilità 1. Apri KeePassXC e...

CVE-2025-56819

CVE-2025-56819 Un problema in Datart v.1.0.0-rc.3 consente a un utente malintenzionato remoto di eseguire codice arbitrario tramite il parametro di connessione INIT. root@kitploit: POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520...

CVE-2012-1675

CVE-2012-1675 Oracle Database TNS Listener Poison Attack Schwachstelle nmap -Pn -sT --script=+oracle-tns-poison -p 1521 192.168.2.18 https://www.integrigy.com/files/Integrigy%20Oracle%20TNS%20Poisoning%20Attacks.pdf...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affetti: Ghost 3.24.0 – 6.19.0 Corretto in: Ghost 6.19.1 Autenticazione richiesta: Nessuna — la chiave dell'API Content è pubblica Impatto: Lettura non autenticata dell'intero database credenziali, chiavi API Vulnerabilità...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

LiteLLM - SQL Injection

LiteLLM 1.81.16 to 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header. id: CVE-2026-42208 info: name: LiteL...

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

PrestaShop SmartBlog <4.0.6 - SQL Injection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. id: CVE-2021-37538 info: name: PrestaShop SmartBlog 4.0.6 - SQL Injection author: whoever severity: critical description: PrestaShop SmartBlog by SmartDataSoft 4.0.6 is...