CVE-2024-28987-POC

描述： SolarWinds Web Help Desk WHD 软件存在硬编码凭据漏洞，允许远程未认证用户访问内部功能并修改数据。 潜在影响： 利用 CVE-2024-28987 可能允许攻击者绕过 SolarWinds Web Help Desk 实施的安全策略，从而导致未经授权访问敏感数据、修改配置或其他恶意操作，进而危及系统完整性。鉴于 Web Help Desk 在企业及政府等关键环境中的广泛使用，该漏洞存在重大风险。 修复： 该公司已在 Web Help Desk 12.8.3 HF2 版本中发布补丁以修复此漏洞。强烈建议用户将软件更新至此版本或更高版本以防范此漏洞。 变通方...

go-dork

go-dork The fastest dork scanner written in Go. There are also various search engines supported by go-dork, including Google, Shodan, Bing, Duck, Yahoo and Ask. Install Usage Basic Usage Flags Querying Defining engine Pagination Adding custom headers Using proxy Chained with other tools Supportin...

CVE-2024-57727

CVE-2024-57727 CVE-2024-57727 python poc.py http://target python poc.py https://192.168.32.130 + https://192.168.32.130 存在漏洞 博客: https://rustlang.rs/posts/simple-help/...

CVE-2026-101270

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

CVE-2026-101270

The software is vulnerable to HTML injection , where malicious HTML content can be injected into the help texts of various fields. This vulnerability is accessible to users with organizer permissions . No specific affected product versions or remediation steps are provided in the documents.

CVE-2026-101270 HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

EUVD-2026-88752

Malicious HTML content could be injected into the help texts of various fields with organizer permissions...

fierce

Fierce Fierce is a DNS reconnaissance tool for locating non-contiguous IP space. Useful links: Domain Name System DNS Domain Names - Concepts and Facilities Domain Names - Implementation and Specification Threat Analysis of the Domain Name System DNS Name Servers NS State of Authority Record SOA...

watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553

CVE-2025-40552 and CVE-2025-40553 SolarWinds Web Help Desk Pre-Auth RCE Chain SolarWinds Web Help Desk Pre-Auth RCE Chain Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if SolarWinds Web Help Desk instance is vulnerable to CVE-2025-40552 and CVE-2025-4055...

security_articles

securityarticles- 连接式V16信标中的漏洞 文章解释了我发现的Help Flash IoT v16信标 中的多个漏洞。这些漏洞影响信标的通信及其通过WiFi的软件更新机制。 2025年12月...

CVE-2023-47246-EXP

Detalles de la vulnerabilidad 1. fofa: body="sysaid-logo-dark-green.png" || title="SysAid Help Desk Software" || body="Help Desk software by SysAid" 2. Versiones afectadas: SysAid Server23.3.36 Recurrencia de la vulnerabilidad 1. Ejecuta el script: git clone...

vuln-chm-hijack

Vulnerabilidad de PuTTY vuln-chm-hijack Posible ejecución de código malicioso mediante el secuestro de CHM Acerca de Hasta la versión 0.70 inclusive, cuando abrías la ayuda en línea en cualquiera de las herramientas GUI de PuTTY para Windows, la herramienta localizaba su archivo de ayuda buscando...

CVE-2024-28987

CVE-2024-28987 CVE-2024-28987 概念验证利用：SolarWinds Web Help Desk 硬编码凭据漏洞 概述 提取最多25张最新票据（API限制） 获取每张票据的完整详情 分析票据ID以估算系统中的总票据数 以结构化目录格式组织输出 设计思路 本工具基于该漏洞的其他利用方法开发。其他利用程序（如MSFconsole）会截断输出，而我希望能查看所有票据的完整内容。 使用方法 python3 solarexploit.py -u https://target.com -o outputdirectory -d delayseconds 法律免责声明...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

crlfuzz

CRLFuzz A fast tool to scan CRLF vulnerability written in Go Resources Installation from Binary from Source from GitHub Usage Basic Usage Flags Target Single URL URLs from list from Stdin Method Data Adding Headers Using Proxy Concurrency Silent Verbose Version Library Help & Bugs License Version...

CVE-2024-28987

CVE-2024-28987: Vulnerabilidad de credenciales codificadas en SolarWinds Web Help Desk Prueba de concepto para explotar CVE-2024-28987 en servidores vulnerables. Publicación del blog Causa raíz e indicadores de compromiso aquí:...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.3-12.3 Autenticado Ejecución Remota de Código Prueba de Concepto Las bases de datos PostgreSQL desde la versión 9.3 hasta la 12.3 la última probada son vulnerables a Ejecución Remota de Código Autenticado. Incluso si el equipo de desarrollo no lo considera una...