CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2016-010033-010045

CVE-2016-010033-010045 PHP 메일 RCE CVE-2016-010033/45가 python3로 이식됨 시작하기 이 지침은 개발 및 테스트 목적으로 로컬 머신에서 프로젝트 사본을 다운로드하고 실행하는 방법을 안내합니다. 라이브 시스템에 프로젝트를 배포하는 방법에 대한 참고 사항은 배포 섹션을 참조하세요. 전제 조건 Python3 설치 root@kitploit: apt-get install python3 root@kitploit: git clone...

Adobe-ColdFusion-8-RCE-CVE-2009-2265

Adobe ColdFusion 8 - リモートコマンド実行（RCE）エクスプロイト 概要 このエクスプロイトは、Adobe ColdFusion 8の既知の脆弱性（CVE-2009-2265）を標的とします。悪意のあるJSPペイロードをアップロードしてリバースシェル接続を確立することで、リモートコマンド実行（RCE）を可能にします。 エクスプロイトの詳細 CVE : CVE-2009-2265 脆弱性 : Adobe ColdFusion 8におけるファイルアップロードの不適切な処理。 影響を受けるバージョン : Adobe ColdFusion 8。 影響 :...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "링크 추적link following 취약점이 Qsync Central에 영향을 미치는 것으로 보고되었습니다. 악용될 경우, 이 취약점으로 인해 사용자 접근 권한을 획득한 원격 공격자가 파일 시스템을 탐색하여...

SmartAsset-SQLinj-CVE-2020-26525

SmartAsset-SQLinj-CVE-2020-26525 Damstra Smart Asset 2020.7 は、API/api/Asset の originator パラメーターを介した SQL インジェクションの脆弱性があります。 Smart Asset - バージョン 2020.7 CVE-2020-26525 ========================== HTTP リクエスト: GET /API/api/Asset?assetCode=XXX-08-X-01-06-01&...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82639

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2021-24884

CVE-2021-24884 Formidable 4.09.04中的XSS2RCE Formidable 4.09.04...

struts2-jakarta-inject

CVE-2017-5638 の POC エクスプロイト このエクスプロイトは、自分が所有するシステム、または明示的なテスト権限があるシステムでのみ使用してください インストール Go がすでにインストールされている場合、go get を使用するのがよいでしょう。 go get github.com/Greynad/struts2-jakarta-inject 使用法 単一コマンドの実行 struts2-jakarta-inject -u -c 'id' 疑似対話型シェル struts2-jakarta-inject -u -i...

CVE-2009-2265

cf8-upload.py ⭐ CVE-2009-2265を悪用するためのPython3スクリプトです。 エクスプロイト - CVE-2009-2265 ❗ このスクリプトは、Adobe ColdFusion 8.0.1に実装されたFCKeditor 2.6.4.1の脆弱性を悪用します： https://vulners.com/cve/CVE-2009-2265 このスクリプトにより、ユーザーはColdFusion 8.0.1が動作するターゲットコンピュータにファイルをアップロードして実行することができます。 前提条件 ✔ python3...

SQLPad-RCE-Exploit-CVE-2022-0944

工作原理： 此 PHP 代码旨在利用 SQLPad 中与 CVE-2022-0944 相关的远程代码执行（RCE）漏洞。 其工作原理是向 SQLPad 应用程序注入恶意代码，强制其执行系统命令，从而打开一个反向 Shell——这是一种连接，可授予攻击者对存在漏洞系统的远程控制权。 先决条件： PHP CLI ——sudo apt-get install php-cli cURL（PHP cURL 库） ——sudo apt-get install php-curl 使用方法： 1. 设置监听器（在攻击者机器上） 要捕获反向 Shell 连接，请在攻击者的机器上启动 Netcat：...

EUVD-2026-68218

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri . In versions prior to 0.11.16 , the EPUB HTML sanitizer (DOMPurify) in apps/readest-app/src/services/transformers/sanitizer.ts forbade only the [removed] tag. Because DOMPurify treats the srcdoc attribute on elements as an opaque string, a ...

CVE-2024-27462

CVE-2024-27462 Wondershare MobileTrans 4.5.6 - 따옴표 없는 서비스 경로 설명: Wondershare Filmora 4.5.6 및 이하 버전에는 여러 개의 따옴표 없는 서비스 경로가 포함되어 있어 공격자가 시스템 수준으로 권한을 상승시킬 수 있습니다. 영향을 받는 서비스 WsAppService3 서비스 바이너리 경로 C:\Program Files x86\Wondershare\WAF3\3.0.0.308\WsAppService3.exe ElevationService 서비스 바이너리 경로...

CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...