CVE-2019-15043

CVE-2019-15043 POC 설명 Grafana 서버가 CVE-2019-15043에 취약한지 확인하는 개념 증명 스캔입니다. Grafana 서버 버전 번호를 확인하고 스냅샷 API가 인증되지 않은 요청을 허용하는지 확인합니다. CVE-2019-15043 CVE-2019-15043은 Grafana 스냅샷 API에서 발견된 서비스 거부 취약점입니다. 이 취약점은 버전 5.4.5 및 6.3.4에서 수정되었습니다. 요구 사항 requests 라이브러리만 필요합니다. pip3 install requests로 설치하세요. 사용법 $...

geo-recon

Geo-Recon An OSINT CLI tool desgined to fast track IP Reputation and Geo-locaton look up for Security Analysts. Pre-requirements for Linux Python3 bash sudo apt install python3 Pip3 bash sudo apt install python3-pip If you don't use Debian or Ubuntu, search for their respective platforms like yum...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169에 대한 수정된 익스플로잇 원본: https://www.exploit-db.com/exploits/51166...

rsyslog-librelp-CVE-2018-1000140-fixed

이 저장소에는 README가 없습니다...

CVE-2023-38120

익스플로잇: SmartRG 라우터에서 발견한 버그에 대한 PoC입니다. 제조사에서 이미 수정되었습니다...

sniffles

Sniffles--Генератор захвата пакетов для IDS и оценки регулярных выражений Sniffles — это инструмент для создания захватов пакетов, которые будут тестировать IDS, использующие фиксированные шаблоны или регулярные выражения для обнаружения подозрительного поведения. Sniffles работает очень просто. ...

QNAP Music Station < 5.4.0 - Authentication Bypass

An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...

Atom CMS v2.0 - SQL Injection

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. id: CVE-2022-24223 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

Vite Dev Server - Directory Traversal

Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a pat...

XWiki DeleteApplication - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

OpenCMS - Cross-Site Scripting

OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. id: CVE-2023-42343 info: name: OpenCMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. impact: | Unauthenticated attackers...

Sonatype Nexus Repository Manager 3 - Local File Inclusion

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. id: CVE-2024-4956 info: name: Sonatype Nexus Repository Manager 3 - Local File Inclusion author: ritikchaddha severity: high description: | Path Traversal in Sonatype...

Symfony HttpFoundation - Access Control Bypass via PATH_INFO

Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...

LocalAI - Partial Local File Read

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...

LearnPress <= 4.2.5.7 - SQL Injection

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

climber

Climber Automated auditing tool to check UNIX/Linux systems misconfigurations which may allow local privilege escalation. Dependencies python = 2.7 python-crypto python-mako python-paramiko Note Climber needs Exscript, a Python module and a template processor for automating network connections ov...

CVE-2022-24637

CVE-2022-24637 CVE-2022-24637에 대한 수정된 익스플로잇 원본 xplt: https://www.exploit-db.com/exploits/51026...

EUVD-2026-91833

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-94592

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...