Zimbra

Active Exploitation of Zimbra CVE-2022-37042 RCE Unauthenticated The following research began by trying to understand the POCs from several GitHub repositories shared by many researchers and ended in an interesting surprise, which I will share in the following paragraphs. On August 10 of this yea...

SysAid Hardware XXE

The vulnerability of the com.ilient.agentApi.LshwAgentdoPost method in SysAid’s automation software for supporting and controlling hardware and software systems is related to incorrect restrictions on XML links to external objects during the processing of the /lshw endpoint. Exploiting this...

CVE-2025-4838

A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function doPost of the file /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java of the component Login. The manipulation of t...

CVE-2025-4838

Vulnerability overview (CVE-2025-4838): Affected product: kanwangzjm Funiture (up to commit 71ca0fb0658b3d839d9e049ac36429207f05329b). The issue is in the Login component, specifically the LoginServlet.java file and its doPost function. The argument ret can be manipulated to induce an open redire...

CVE-2025-4838: URL Redirection to Untrusted Site

A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function doPost of the file /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java of the component Login. The manipulation of t...

SysAid Code Execution

The vulnerability of the doPost method in the UserEntry class of the com.ilient.server package in the SysAid software for hardware and software support and control involves the possibility of path traversal. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading...

CVE-2023-50565

A cross-site scripting XSS vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-50565

A cross-site scripting XSS vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2023-31589 · Rpcms · Rpcms

Name of the Vulnerable Software and Affected Versions: RPCMS version 3.5.5 Description: A cross-site scripting XSS issue in the component "/logs/dopost.html" allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For RPCMS version 3.5.5, consider disabli...

RPCMS Cross-Site Scripting Vulnerabilities

RPCMS is a software application, a web CMS system. A cross-site scripting vulnerability exists in RPCMS v3.5.5, which stems from the lack of effective filtering and escaping of user-supplied data in the component /logs/dopost.html, and can be exploited by an attacker to execute arbitrary Web scri...

SysAid doPost Code Execution

The vulnerability of the doPost method in the UserEntry class of the com.ilient.server package in the SysAid software for hardware and software support and control involves the possibility of path traversal. Exploiting this vulnerability could allow an attacker to execute arbitrary code by loadin...

PT-2023-6781

Name of the Vulnerable Software and Affected Versions SysAid On-Premise versions prior to 23.3.36 Description A path traversal vulnerability in SysAid On-Premise software leads to code execution after an attacker writes a file to the Tomcat webroot. This issue has been exploited in the wild, with...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

Explotación Activa Sobre Zimbra CVE-2022-37042 RCE Unauthent...

CVE-2022-36583

DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...

CVE-2022-36583

DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...

CVE-2022-36583

DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...

CVE-2022-36583: Improper Neutralization of Input During Web Page Generation

DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...

DedeCMS cross-site scripting vulnerability

DedeCMS 织梦内容管理系统 is a PHP-based open source content management system CMS from China's Zhuo Zhuo Network Desdev. The system features content publishing, content management, content editing and content retrieval.A security vulnerability exists in DedeCMS version V5.7.97, which was discovered to...

PT-2018-9857

Name of the Vulnerable Software and Affected Versions: DedeCMS version V5.7 SP2 Description: A file uploading issue exists, allowing attackers to upload and execute arbitrary PHP code. This can be achieved via the /dede/archives do.php?dopost=uploadLitpic endpoint, specifically through the litpic...

ZENworks Configuration Management doPost Arbitrary File Execution

The vulnerability of the GetReRequestData method in the GetStoredResult class of the ZENworks Configuration Management information system is related to the failure to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using...