CVE-2017-20285

YAML versions before 1.30 for Perl are vulnerable to an issue where a loaded document can trigger the DESTROY method of arbitrary classes. The vulnerability occurs because a perl/hash:Class tag blesses a hash into a class named within the document, and Perl automatically calls the DESTROY method ...

chromecookiestealer

Chrome Cookie Stealer and injector Attaches to Chrome using its Remote DevTools protocol and steals/injects/clears/deletes cookies. Heavily inspired by WhiteChocolateMacademiaNut. Cookies are dumped as JSON objects using Chrome's own format. The same format is used for cookies to be loaded. For...

delete-self-poc

🗑️ delete-self-poc El delete-self-poc es una demostración de un método para eliminar un ejecutable bloqueado o un archivo actualmente en ejecución del disco. Este concepto fue descubierto inicialmente por Jonas Lykkegaard, y yo he creado la prueba de concepto POC para el mismo. Además, puede...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP 在 Windows 系统上，发现 GlobalProtect（App 版本 6.1.1-5 和 6.2.0-89）存在通过符号链接攻击以 SYSTEM 权限进行任意文件删除的漏洞，从而导致本地权限提升。 经观察，当 Windows 非特权用户尝试使用 GlobalProtect 连接 VPN 时，进程 "PanGpHip.exe" 会以 SYSTEM 权限执行以下操作： 1. 查询目录 "C:\Users\AppData\Local\Temp\waapi-" 2. 如果发现任何目录，将进一步查询目录...

firehol

FireHOL http://firehol.org/ FireHOL, an iptables stateful packet filtering firewall for humans! FireQOS, a TC based bandwidth shaper for humans! Git These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade Notes. Cloning...

CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2025-21420_POC

Comparación de cleanmgr.exe La nueva versión de cleanmgr.exe incluye una llamada a la función SetProcessMitigationPolicy. Con MitigationPolicy establecido en 16, correspondiente a ProcessRedirectionTrustPolicy. Combinado con la descripción de Microsoft de CWE-59: Resolución incorrecta de enlaces...

s3sec

s3sec 测试AWS S3存储桶的读/写/删除访问权限 该工具用于快速测试一系列S3存储桶的公开读、写和删除访问权限，适用于漏洞赏金计划中的渗透测试。 截图 使用此工具发现了漏洞赏金？欢迎加我作为协作者：@0xmoot : 安装 将git仓库克隆到本地机器： git clone https://github.com/0xmoot/s3sec 祝狩猎愉快 : 使用 检查单个S3实例： echo "test-instance.s3.amazonaws.com" | python3 s3sec.py 或者： echo "test-instance" | python3 s3sec.py...

s3sec

s3sec Test AWS S3 buckets for read/write/delete access This tool was developed to quickly test a list of s3 buckets for public read, write and delete access for the purposes of penetration testing on bug bounty programs. Screenshot Found a bug bounty using this tool? Feel free to add me as a...

CVE-2023-40868

CVE-2023-40868 mooSocial MooSocial Software v.Demo 中存在跨站请求伪造漏洞，远程攻击者可利用该漏洞通过“删除账户”和“停用账户”功能执行任意代码。 该漏洞是 mooSocial MooSocial Software v.Demo 应用程序中的一个跨站请求伪造（CSRF）漏洞。CSRF 漏洞是指恶意攻击者可以诱骗受害者执行其本无意执行的操作。在这种情况下，攻击者可以诱骗受害者点击包含恶意代码的链接或打开包含恶意代码的文件。该代码随后可用于删除或停用受害者的账户。 POC 1 - 创建一个包含以下代码的文件，并保存为 HTML 文件...

CVE-2019-14529

CVE-2019-14529 OpenEMR 项目中的多个 SQL 注入漏洞 漏洞文件中的漏洞函数： /openemr/interface/forms/eyemag/save.php 条件 ：任意授权用户 受影响版本： 5.0.2，已在 5.0.2 版本中修复。 描述 存在两个函数： 1. "storePDF"，使用了未经过滤的变量 "encounter"， 2. "canvas"，使用了两个未经过滤的变量 "encounter" 和 "zone"。 这两个函数都在 DELETE SQL 查询中使用这些变量，且没有任何过滤。这两个变量均可由攻击者控制。 错误消息包含 SQL 查询代码和...

Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. id: CVE-2021-46424 info: name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete author: gy741 severity:...

OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete

OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory. id: CVE-2024-35219 info: name: OpenAPI Generator = 7.5.0 - Arbitrary File...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

EUVD-2026-92043

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-0603

CVE-2026-0603 Inyección en Hibernate ORM / Inyección SQL de Segundo Orden ★ CVE-2026-0603 PoC de Inyección SQL en Hibernate ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Descripción general CVE-2026-0603 es una vulnerabilidad de Inyección SQL de Segundo Orden e...

PT-2026-104621

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql...

CVE-2025-34157

Coolify 删除流程中的存储型 XSS（CVE-2025-34157） 受影响版本： Coolify ≤ v4.0.0-beta.420.6 修复版本： v4.0.0-beta.420.7 严重性： 严重（9.4） CVSS 4.0 向量： CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE： CWE-79（跨站脚本），CWE-20（输入验证不当） 摘要 项目删除流程中的存储型 XSS 允许攻击者在管理员尝试删除由低权限用户创建的项目时，在管理员的浏览器中执行攻击者控制的 JavaScript。这可能...