EUVD-2021-34882

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

CVE-2021-48008 Chanjet CRM SQL Injection via get_usedspace.php

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

CVE-2021-48008

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

EUVD-2019-20203

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...

CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection in the mobile plugin endpoint (SyncUserInfo.jsp), reachable via the userIdentifiers GET parameter . Attackers bypass space-based WAF filters by wrapping SQL keywords in parentheses, enabling UNION-based injection that exposes administrator...

CVE-2019-25776 Weaver E-cology SQL Injection via SyncUserInfo.jsp

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...

CVE-2026-93852

OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

EUVD-2026-83273

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

ShuckNT

🔐 ShuckNT : クラックする前にハッシュをシュック | Shuck.sh のスクリプト ShuckNT は、Shuck.sh オンラインサービスのスクリプトで、オンプレミスで使用するためのものです（オンラインで試す!）。Data Encryption Standard DES に基づく認証トークンをダウングレード、変換、解析、およびシュックするために設計されています。 対応アルゴリズム / フォーマット : MSCHAPv2 NETNTLM LM|NTHASH PPTP-VPN $99$ 任意のチャレンジ値にもすべて対応! ShuckNT は、ハッシュ・シュッキング...

BHPAI

プロジェクトドキュメント: BHPAI システムバージョン : V1.6 Enterprise Edition システム機能の全面アップデート 著者 : Rin449 コア言語 & 技術: C++17 MinGW-w64 / MSYS2, Python 3.9+, PyQt6, MinHook, Capstone Engine, Intel PT Processor Trace, PyTorch, LightGBM, OpenSSL 3.x, zlib, Argon2id, Cryptography, Ed25519 マスタ参照ドキュメント :...

Exploit for CVE-2026-45140

abraxaslabs.tech · github.com/abraxas ·&...

Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server

On September 1, 2026, the libheif project released version 1.23.3, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported four days earlier. The libheif maintainer, Dirk Farin, gave it a score of 9.8 out of 10 on the CVS...

CVE-2025-5781

FreePBX CVE-2025-57819 エクスプロイト 説明 このスクリプトは、FreePBX 16.0.26.0 未満のバージョン（CVE-2025-57819）の脆弱性を悪用し、AJAX API エンドポイントの SQL インジェクションの欠陥を介して、リモート攻撃者が任意の PHP コードを実行できるようにします。このエクスプロイトは、ウェブシェルと自動起動するリバースシェルの両方を作成します。 脆弱性の詳細 CVE : CVE-2025-57819 影響を受けるバージョン : FreePBX 16.0.26.0 影響 : リモートコード実行 RCE ベクトル : AJAX...

TryHack3M-Bricks-Heist

TryHack3M: Bricks Heist Exploit • Writeup • CTF Challenge A comprehensive repository containing a custom exploit and detailed writeup for the TryHack3M: Bricks Heist challenge Quick Start • Repository Structure • The Exploit • The Writeup • Disclaimer Overview This repository documents the...

CVE-2025-10951

CVE-2025-10951 - checkmlloggertraversal.py CVE-2025-10951 / GHSA-8x9j-2p8r-7xc6 の存在確認チェッカー — geyang/ml-logger（≤ 0.10.36）における 未認証のパストラバーサルで、mllogger/server.py の loghandler / streamhandler 関数に影響します。 テストを許可されたシステムに対してのみ使用してください。 チェック内容 エンドポイント| メソッド| 目的 ---|---|--- /glob| POST|...

CVE-2022-44877

go-exploit 모듈 사용 모듈 모드가 꺼져 있을 때 root@kitploit: go get github.com/vulncheck-oss/go-exploit 모듈 모드가 켜져 있을 때 root@kitploit: go mod init example.com/myapp go get github.com/vulncheck-oss/go-exploit 빌드 root@kitploit: go build -o cve-2022-44877 main.go...

GitLabSniper

GitLabSniper CVE-2026-85706 — GitLab CE/EE 未認証の任意ファイル読み取り 検出 · 公開プロジェクト列挙 · 回収 · 対話型シェル · subfinder/httpx パイプライン Author: Yunus Emre Öztaş mitsec X: x.com/ynsmroztas GitHub: github.com/ynsmroztas Site: ynsmroztas.github.io Mail: [email protected] 所有または明示的にテストを許可されたシステム（バグバウンティ / VDP /...