CVE-2024-28987

CVE-2024-28987 : Vulnérabilité de mot de passe codé en dur dans SolarWinds Web Help Desk Preuve de concept pour exploiter CVE-2024-28987 sur les serveurs vulnérables. Article de blog Cause racine et indicateurs de compromission ici :...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

SolarWinds Web Help Desk - Hardcoded Credential

The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. id: CVE-2024-28987 info: name: SolarWinds Web Help Desk - Hardcoded Credential author:...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

CVE-2023-47246-EXP

Détails de la vulnérabilité 1. fofa: root@kitploit: body="sysaid-logo-dark-green.png" || title="SysAid Help Desk Software" || body="Help Desk software by SysAid" 2. Versions affectées : SysAid Server23.3.36 Reproduction de la vulnérabilité 1. Exécutez le script : root@kitploit: git clone...

CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Détournement de compte privilégié Date : 30-03-2019 Auteur de l'exploit : Ata Hakçıl, Melih Kaan Yıldız Vendeur : ManageEngine Page d'accueil du vendeur :www.manageengine.com Produit : Service Desk Plus Version : 10.0 Testé sur : Windows 10 64 bit...

CVE-2024-28987-POC

Описание : Программное обеспечение SolarWinds Web Help Desk WHD подвержено уязвимости жёстко заданных учётных данных, позволяющей удалённому неаутентифицированному пользователю получать доступ к внутренней функциональности и изменять данные. Потенциальное воздействие : Эксплуатация CVE-2024-28987...

CVE-2024-28987

CVE-2024-28987 CVE-2024-28987에 대한 개념 증명 익스플로잇: SolarWinds Web Help Desk 하드코딩된 자격 증명 취약점 개요 최근 티켓 최대 25개 추출API 제한 각 티켓의 전체 세부 정보 검색 티켓 ID를 분석하여 시스템 내 전체 티켓 수 추정 구조화된 디렉터리 형식으로 출력 구성 설계 동기 이 도구는 이 취약점에 대한 다른 익스플로잇을 기반으로 합니다. 다른 익스플로잇예: MSFconsole은 출력을 잘라내는 경향이 있어, 저는 모든 티켓의 전체 내용을 보고 싶었습니다. 사용법...

CVE-2025-26399

CVE-2025-26399 Как работает этот метод обнаружения? Этот скрипт обнаруживает экземпляры SolarWinds Web Help Desk, уязвимые для CVE-2025-26399, путем запроса страницы входа Helpdesk, подтверждения идентификаторов продукта в ответе, извлечения встроенного токена сборки в качестве строки версии и...

CVE-2025-40554

CVE-2025-40554 Suite d'Exploitation Un outil complet de test de sécurité pour détecter et exploiter la vulnérabilité de contournement d'authentification CVE-2025-40554 / CVE-2025-40536 dans SolarWinds Web Help Desk. ⚠️ Avertissement À DES FINS ÉDUCATIVES ET DE TEST DE SÉCURITÉ AUTORISÉ UNIQUEMENT...

CVE-2025-67223

CVE-2025-67223 : Contrôle d'accès incorrect et divulgation d'informations dans Aranda Service Desk Identifiant CVE : CVE-2025-67223 Produit affecté : Aranda Service Desk module Aranda File Server - AFS Versions affectées : 8.3.12 Auteur : Brandon Perez Lara 🚨 Aperçu Une vulnérabilité critique a é...

CVE-2024-28987

CVE-2024-28987 - Exploitation des identifiants codés en dur de SolarWinds Web Help Desk ⚠️ AVERTISSEMENT : Cet outil est destiné uniquement à des fins de tests de sécurité éducatifs et autorisés. L'accès non autorisé à des systèmes informatiques est illégal. Utilisez cet outil uniquement sur des...

auth-bypass-CVE-2025-40554

CVE-2025-40554 – SolarWinds Web Help Desk Обход аутентификации PoC Shodan запрос root@kitploit: http.favicon.hash:"1895809524" Nuclei root@kitploit: nuclei -u https://TARGET:8443 -t CVE-2025-40554.yaml nuclei -l listtarget.txt -t CVE-2025-40554.yaml root@kitploit: pip install -r requirements.txt...

VulnCheck KEV: CVE-2025-40553

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication...

watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553

CVE-2025-40552 et CVE-2025-40553 Chaîne RCE sans authentification préalable de SolarWinds Web Help Desk Outil de génération d'artefacts de détection pour la chaîne RCE sans authentification préalable de SolarWinds Web Help Desk Description Ce générateur d'artefacts de détection vérifie si une...

Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

On September 2, 2026, the Cisco Product Security Incident Response Team PSIRT published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026...