137 matches found
CVE-2020-14882
CVE-2020-14882 desplegando un memory shell de Behinder Como es bien sabido, CVE-2020-14882 es una vulnerabilidad no autenticada que permite a un atacante ejecutar código arbitrario en el WebLogic Server afectado. En los PoC públicos, el acceso se logra mediante la omisión de caracteres ilegales y...
cve-2020-14882
CVE-2020-14882 Versiones afectadas: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 POC: root@kitploit: http://IP:7001/console/images/%252E%252E%252Fconsole.portal?nfpb=false&pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession"java.lang.Runtime.getRuntime.exec'calc.exe';";...
cve-2021-41773-lab
CVE-2021-41773 — 极简 FastAPI 实验环境 一个小型自包含的 FastAPI 实验环境，演示了在验证文件系统边界之前解码用户输入如何导致目录遍历和本地文件包含（LFI），该环境模拟了 Apache HTTP Server 的 CVE-2021-41773 问题。 功能 极简且易于阅读的 FastAPI 示例：一个易受攻击的服务器和一个已修补的服务器 演示单重编码（%2e）和双重编码（%252e）绕过 根端点包含用于 curl 测试的快速有效载荷 无需 Docker — 使用 uvicorn 在本地运行 仓库结构 patchedapp.py —...
CVE-2024-38816-PoC
CVE-2024-38816 Prueba de Concepto PoC Esta es una prueba de concepto para la vulnerabilidad CVE-2024-38816, que demuestra un exploit de path traversal. Pasos de Ejecución 1. Construye la imagen de Docker: Spring Boot 3.0.13, basado en Spring Framework 6.0.3 root@kitploit: docker build -t...
DrupalCVE-2018-7602
Vulnerabilidad de ejecución remota de código en Drupal CVE-2018-7602 Software afectado: drupal Método: codificar dos veces el de la URL para evadir el filtro de la función sanitize Efecto: ejecución de comandos arbitrarios Entorno vulnerable Ejecute el siguiente comando para iniciar el entorno de...
CVE-2025-0108
CVE-2025-0108 — Sicurezza Web PoC & Fix Questa repository contiene un piccolo ambiente di laboratorio per riprodurre e mitigare il problema CVE-2025-0108 confusione del percorso / header smuggling tra Nginx e Apache. L'obiettivo dell'esercizio è dimostrare come le richieste con doppia codifica...
CVE-2021-42013
CVE-2021-42013 Servizio vulnerabile Installazione Diverse opzioni: 1. Container Docker root@kitploit: docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile root@kitploit: git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd...
GO-2026-4950 Authorization bypass via double-encoded paths in github.com/valyala/fasthttp
In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '' as URI delimiters. In applications where authorization guards inspect ctx.Path before passing paths to file-serving...
CVE-2026-14922
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...
CVE-2026-13609
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...
CVE-2026-13609 Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...
CVE-2026-14922 WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...
EUVD-2026-51419
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...
CVE-2026-14922
WP Photo Album Plus is affected by a stored cross-site scripting (XSS) vulnerability affecting all versions up to 9.2.03.001. The flaw arises in the photo-comment pipeline due to a decode-after-sanitize (double-encoding) sequence: on write, wppa_do_comment() sanitizes input with wppa_filter_html(...
CVE-2026-13400
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
EUVD-2026-49072
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
GHSA-P4M3-MGMM-C664 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
Summary The patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint, default port 6808, an unauthenticated remote attacker can read arbitrary...
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
Summary The patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint, default port 6808, an unauthenticated remote attacker can read arbitrary...
