solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. ============================================ | Collecting...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 is an open source monitoring web interface, framework and command line interface. Unauthenticated users can leak the contents of user-accessible local system files from the web server, including icingaweb2 configuration files with database credentials. Installation Usa...

CVE-2022-24716

CVE-2022-24716 Icinga Web 2 is a software application that monitors computer systems and networks. It has a web interface that allows users to view and manage system resources. However, there is a vulnerability in Icinga Web 2 that allows unauthenticated users to access files on the system that a...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

CVE-2023-23752-Docker

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023-23752 Dockerized Installation Recommended automatic 1. Clone this repo git clone https://github.com/karthikuj/CVE-2023-23752-Docker.git 2. Change directory cd CVE-2023-23752-Docker 3. Run ./setup.sh 4. Open your browser and go to...

CVE-2024-50961

Sensitive Data Exposure CVE-2024-50961 Description In DonWeb Ferozo Hosting v1.1, a remote attacker can exploit URL parameters to access sensitive data, including database credentials. Attack vectors include network sniffing, server logs, and browser history, potentially exposing organizations to...

EUVD-2014-9822

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

solarflare

solarflare SolarWinds Orion 用の資格情報ダンプツール ブログ記事: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ DPAPI の解明に協力してくれた @asolino, @gentilkiwi, @skelsec に感謝します。 ============================================ | Collecting RabbitMQ Erlang Cookie | Erlang Cookie:...

SSCMS_Decrypt

sscms（siteserver cms） database decrypt Introducción: SSCMS se basa en .NET Core y permite poner en marcha una plataforma web completa, de alto rendimiento, a gran escala y fácil de mantener, con el menor coste, la menor inversión de personal y en el menor tiempo posible. Dirección del proyecto:...

CVE-2024-53522

CVE-2024-53522 PoC de explotación para CVE-2024-53522 Este repositorio contiene la Prueba de Concepto PoC para CVE-2024-53522 , una vulnerabilidad descubierta por Safecloud Co., Ltd. Para obtener información detallada sobre la vulnerabilidad, consulte nuestra publicación en el blog: CVE-2024-5352...

CVE-2025-8081-Elementor

CVE-2025-8081 - Vulnerabilidad de Lectura Arbitraria de Archivos en Elementor Una vulnerabilidad crítica de lectura arbitraria de archivos en el plugin de WordPress Elementor que permite a administradores autenticados leer cualquier archivo accesible por el servidor web, incluidos archivos de...

CVE-2023-23752-poc

Affected versions: 4.0.0 = 4.2.8 Joomla 3 and below are not affected by this vulnerability. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true This API is used to obtain the most important configuration information of the website, including the database username and password...

EUVD-2023-60699

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

CVE-2023-54403 Yonyou U8 CRM Arbitrary File Read via getemaildata.php

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

UBUNTU-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

DBconfigReader

Vulnerabilidad de filtración de información de configuración de base de datos en la interfaz del sistema OA ecology de Weaver /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp La auditoría de código de Fortify detecta un algoritmo de cifrado débil SecretKey key =...