CVE-2024-28987

CVE-2024-28987 : Vulnérabilité de mot de passe codé en dur dans SolarWinds Web Help Desk Preuve de concept pour exploiter CVE-2024-28987 sur les serveurs vulnérables. Article de blog Cause racine et indicateurs de compromission ici :...

CVE-2023-47246-EXP

Détails de la vulnérabilité 1. fofa: body="sysaid-logo-dark-green.png" || title="SysAid Help Desk Software" || body="Help Desk software by SysAid" 2. Versions affectées : SysAid Server23.3.36 Reproduction de la vulnérabilité 1. Exécutez le script : git clone...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

FreeScout < 1.8.224 - Invite Hash Authorization Bypass

FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invitehash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. id: CVE-2026-53595 info:...

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

CVE-2024-28987

CVE-2024-28987 Exploit Proof of Concept pour CVE-2024-28987 : Vulnérabilité d'Identifiants Codés en Dur dans SolarWinds Web Help Desk Vue d'ensemble Extrait jusqu'à 25 tickets les plus récents limitation de l'API Récupère les détails complets de chaque ticket Analyse les identifiants des tickets...

CVE-2024-28987-POC

Описание : Программное обеспечение SolarWinds Web Help Desk WHD подвержено уязвимости жёстко заданных учётных данных, позволяющей удалённому неаутентифицированному пользователю получать доступ к внутренней функциональности и изменять данные. Потенциальное воздействие : Эксплуатация CVE-2024-28987...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

CVE-2025-40554

CVE-2025-40554 Suite d'Exploitation Un outil complet de test de sécurité pour détecter et exploiter la vulnérabilité de contournement d'authentification CVE-2025-40554 / CVE-2025-40536 dans SolarWinds Web Help Desk. ⚠️ Avertissement À DES FINS ÉDUCATIVES ET DE TEST DE SÉCURITÉ AUTORISÉ UNIQUEMENT...

CVE-2024-28987

CVE-2024-28987 - Эксплойт жёстко заданных учётных данных SolarWinds Web Help Desk ⚠️ ПРЕДУПРЕЖДЕНИЕ: Этот инструмент предназначен только для образовательных целей и авторизованного тестирования безопасности. Несанкционированный доступ к компьютерным системам незаконен. Используйте этот инструмент...

auth-bypass-CVE-2025-40554

CVE-2025-40554 – SolarWinds Web Help Desk Обход аутентификации PoC Shodan запрос http.favicon.hash:"1895809524" Nuclei nuclei -u https://TARGET:8443 -t CVE-2025-40554.yaml nuclei -l listtarget.txt -t CVE-2025-40554.yaml pip install -r requirements.txt Использование Одиночная цель обход + вход, по...

watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553

CVE-2025-40552 et CVE-2025-40553 Chaîne RCE sans authentification préalable de SolarWinds Web Help Desk Outil de génération d'artefacts de détection pour la chaîne RCE sans authentification préalable de SolarWinds Web Help Desk Description Ce générateur d'artefacts de détection vérifie si une...

CVE-2025-26399

CVE-2025-26399 Comment fonctionne cette méthode de détection ? Ce script détecte les instances SolarWinds Web Help Desk vulnérables à CVE-2025-26399 en demandant la page de connexion Helpdesk, en confirmant les identifiants de produit dans la réponse, en extrayant le jeton de build intégré comme...

SolarWinds Web Help Desk - Hardcoded Credential

The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. id: CVE-2024-28987 info: name: SolarWinds Web Help Desk - Hardcoded Credential author:...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service SaaS offerings through information technology IT help desk vishing, adversary-in-the-middle AitM token theft, and residential-proxy sign-ins...

VulnCheck KEV: CVE-2025-40553

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication...