CVE-2021-26084_Confluence

CVE-2021-26084 - Iniezione OGNL in Webwork di Confluence Server Esiste una vulnerabilità di iniezione OGNL che permetterebbe a un utente autenticato e in alcuni casi a un utente non autenticato di eseguire codice arbitrario su un'istanza di Confluence Server o Data Center. IMPORTANTE Questo explo...

FUDforum-XSS-RCE

FUDforum-XSS-RCE FUDForum 3.0.9 - XSS / Esecuzione di codice remoto CVE-2019-18873, CVE-2019-18839 Sono state trovate multiple vulnerabilità XSS persistenti in FUDforum 3.0.9 che possono portare a esecuzione di codice remoto. XSS persistente tramite nome utente nel forum: Informazioni |...

CVE-2019-11932

CVE-2019-11932 Die Adresse von system und des Gadgets müssen durch die tatsächliche Adresse ersetzt werden, die durch eine Information-Disclosure-Schwachstelle gefunden wurde. Nach dem Ersetzen der Adresse von system und des Gadgets. Führen Sie den Code aus, um die beschädigte GIF-Datei zu...

CVE-2025-7441

CVE-2025-7441 StoryChief data - sizes - full फ़ील्ड किसी मनमाने URL की ओर इंगित करता है। StoryChief पर्याप्त फ़ाइल प्रकार/सामग्री सत्यापन नहीं करता है या URL स्रोत को प्रतिबंधित नहीं करता है, जिससे प्लगिन दूरस्थ संसाधन को लाकर साइट की अपलोड निर्देशिका में सहेज सकता है। निष्पादन योग्य कोड वाली...

CVE-2024-28515

CVE-2024-28515 Descrição Vulnerabilidade de estouro de buffer no CSAPPLab CSAPP Lab3 15-213 Fall 20xx permite que um atacante remoto execute código arbitrário através do componente lab3 do csapp, lab3/buflab-update.pl. Informações Adicionais O CNVD concluiu a verificação desta vulnerabilidade, ma...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2018-2628

weblogic getshell पिछले डेवलपर्स के स्क्रिप्ट को अनुकूलित करके कोड को Python 3 में चलाने योग्य बनाया गया है। मुख्य रूप से विंडोज़ पर। संदर्भ लिंक https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2628/README.zh-cn.md https://github.com/0xMJ/CVE-2018-2628 weblogic getshell भेद्यता...

CVE-2026-25512

CVE-2026-25512: Esecuzione di codice in remoto tramite iniezione di comandi nel gestore TNEF - Group-Office Vettore CVSS 4.0 : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Indice Riepilogo Versioni interessate Dettagli tecnici Causa principale Flusso dalla sorgente al sink...

CVE-2019-7609

CVE-2019-7609 Kibana ثغرة تسمح بتنفيذ التعليمات البرمجية عن بعد بسبب خلل في مصور Timelion في Kibana الإعداد البيئي docker 1. قم بتشغيل ملف docker-compose.yml المرفق. root@kitploit: docker-comopse up -d 2. قم بزيارة http://127.0.0.1:5601 في المتصفح. الاستغلال 1. قم بإعداد shell عكسي. root@kitploit...

CVE-2019-9202

CVE-2019-9202 Nagios IM 2.6 Exploit zur Remote-Code-Ausführung: CSRF + SQLi + RCE + LPE -- Remote-Root Beschreibung Durch die Verkettung einer Cross-Site-Request-Forgery CSRF / Autorisierungsumgehung CVE-2019-9203 ist es möglich, eine Union-basierte SQL-Injection CVE-2019-9204, eine...

CVE-2024-7954-RCE

Beschreibung Das porteplume-Plugin, das von SPIP vor Version 4.30-alpha2, 4.2.13 und 4.1.16 verwendet wird, ist anfällig für eine Schwachstelle zur Ausführung beliebigen Codes. Ein entfernter, nicht authentifizierter Angreifer kann beliebigen PHP-Code als SPIP-Benutzer ausführen, indem er eine...

CVE-2023-26035

POC für CVE-2023-26035 Funktioniert für ZoneMinder Versionen vor 1.36.33 und 1.37.33 Schwachstelle : Remote Code Execution RCE Verwendung root@kitploit: └─➜ python3 poc.py -h usage: poc.py -h --target TARGET --cmd CMD poc.py: error: the following arguments are required: --target, --cmd Curl Bevor...

CVE-2018-1273

CVE-2018-1273 Spring Data Commons, versioni precedenti da 1.13 a 1.13.10, da 2.0 a 2.0.5, e versioni più vecchie non supportate, contengono una vulnerabilità del property binder causata da una neutralizzazione impropria di elementi speciali. Un utente malintenzionato remoto non autenticato o...

wshlient

Wshlient Client Web Shell Descrizione e demo Wshlient è un client web shell progettato per essere piuttosto semplice ma versatile. Basta creare un file di testo contenente una richiesta HTTP e indicare dove Wshlient deve iniettare i comandi, e potrai usufruire di una shell...

CVE-2023-0297

CVE-2023-0297 Nicht authentifizierte Remote-Codeausführung in PyLoad 0.5.0b3.dev31 HAFTUNGSAUSSCHLUSS: Dieses Skript dient der Überprüfung der Systemsicherheit. Verwenden Sie dieses Skript nur auf Ihren eigenen Systemen oder auf Systemen, für die Sie eine schriftliche Erlaubnis zum Ausnutzen...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

CVE-2024-30167

Atlona OME प्रमाणित कमांड इंजेक्शन के लिए PoC अस्वीकरण : यह प्रूफ ऑफ कॉन्सेप्ट केवल शैक्षिक और अनुसंधान उद्देश्यों के लिए प्रदान किया गया है। इस कोड का उपयोग उन सिस्टमों पर न करें जिनके आप मालिक नहीं हैं या जिनके परीक्षण के लिए आपके पास स्पष्ट अनुमति नहीं है। मैं किसी भी दुरुपयोग के लिए जिम्मेदार...