CVE-2021-29378

SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php...

Sql injection

SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php...

CVE-2021-29378

SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php...

Pear Admin Think SQL Injection Vulnerability

Pear Admin Think is open source rapid development platform based on thinkphp6, with simple code generation features, you can quickly build your functional business. A security vulnerability exists in Pear Admin Think version 2.1.2, which stems from a vulnerability that allows an attacker to execu...

CVE-2021-29378

SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php...

Citrix ADC nsppe buffer overflow

Added: 08/09/2023 CVE: CVE-2023-3519 Background Citrix ADC formerly NetScaler ADC is an application delivery and load balancing platform. Problem A buffer overflow vulnerability in the nsppe process in Citrix ADC allows an unauthenticated attacker to execute arbitrary commands by making a special...

CVE-2023-38999

A Cross-Site Request Forgery CSRF in the System Halt API /system/halt of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service DoS via a crafted GET request...

Citrix ADC nsppe buffer overflow

Added: 08/09/2023 CVE: CVE-2023-3519 Background Citrix ADC formerly NetScaler ADC is an application delivery and load balancing platform. Problem A buffer overflow vulnerability in the nsppe process in Citrix ADC allows an unauthenticated attacker to execute arbitrary commands by making a special...

CVE-2023-38999

A Cross-Site Request Forgery CSRF in the System Halt API /system/halt of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service DoS via a crafted GET request...

Metasploit Weekly Wrap-Up

Fly High in the Sky With This New Cloud Exploit! This week, a new module was added that takes advantage of both authentication bypass and command injection in certain versions of Western Digital's MyCloud hardware. Submitted by community member Erik Wynter, this module gains access to the target,...

Citrix ADC (NetScaler) Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Citrix ADC NetScaler Forms SSO Target RCE', 'Description' = %q A vulnerability exists within Citrix ADC that allows an unauthenticated attacker t...

Exploit for Use of Externally-Controlled Format String in Asus Rt-Ac86U_Firmware

CVE-2023-35086-POC July 25 2023, Altin tin-z, github.com/t...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

Cross site request forgery (csrf)

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

WebBoss.io 安全漏洞

WebBoss.io is a website building platform for professional designers and developers from WebBoss.io. A security vulnerability exists in WebBoss.io CMS version v3.7.0, which stems from an access control issue that allows an attacker to access the website backup tool via a crafted GET request...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

The vulnerability of D-Link DIR-823G router microprogramming software, related to the failure to take measures to neutralize special elements, allows a hacker to execute arbitrary commands.

The vulnerability of D-Link DIR-823G router microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the EXCUSHELL header. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a specially...

New in Spring 6.1: RestClient

Spring Framework 6.1 M2 introduces the RestClient, a new synchronous HTTP client. As the name suggests, RestClient offers the fluent API of WebClient with the infrastructure of RestTemplate. Fourteen years ago, when RestTemplate was introduced in Spring Framework 3.0, we quickly discovered that...

The vulnerability of the AccessCtrlTimeSchedRpm component (/userRpm/AccessCtrlTimeSchedRpm.htm) in the TP-Link routers such as TL-WR940N, TL-WR841N, TL-WR941N, TL-WR940N, and TL-WR740N allows a hacker to cause service failures.

The vulnerability of the AccessCtrlTimeSchedRpm component /userRpm/AccessCtrlTimeSchedRpm.htm of the TP-Link routers TL-WR940N, TL-WR841N, TL-WR941N, TL-WR940N, and TL-WR740N is related to the execution of an operation outside the buffer in memory when processing the Changed parameter. Exploiting...