CVE-2023-23752

CVE-2023-23752 用于Joomla CVE-2023-23752扫描的简单程序。这是一个简单的Ruby脚本，用于检查目标列表是否易受CVE-2023-23752攻击，该漏洞是一个严重的Web应用程序安全漏洞。脚本向指定端点发送HTTP GET请求，并从响应中提取信息以判断目标是否存在漏洞。 用法 root@kitploit: ruby scanner.rb list.txt output.txt list.txt文件包含一系列目标域名或IP，每行一个。output.txt是保存结果的输出文件。 需求 该脚本需要以下Ruby gem： root@kitploit: httpar...

CVE-2018-11776

CVE-2018-11776 对CVE-2018-11776漏洞的调查，该漏洞允许攻击者远程执行代码并控制基于Apache Struts的应用程序。 安装与利用 https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Suricata 文件"test.rules"中提供了一条用于Suricata工具的规则。该规则可检测网络流量中的可利用漏洞。 该规则在/etc/suricata/suricata.yaml文件中被引用： root@kitploit: default-rule-path: /etc/suricata rule-files:...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC 用于 Veracode 博客的代码 为了演示代码执行： 1. 使用 Maven 构建项目 2. 执行 python3 -m http.server 8080 以运行 HTTP 服务器 3. 运行 exploit.java。你应该会在服务器上观察到一次 HTTP GET 请求 4. 为了演示 SnakeYAML 2.0 如何防止该攻击，请注释掉 pom.xml 中的 1.33 依赖 5. 取消注释 2.0 依赖，然后重新构建项目 6. 注释掉 exploit.java 并取消注释 Poc.java 7. 运行 Poc.java 并观察...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /management/stop handler in the metrics management server on port 9091. An attacker can terminate the proxy, datanode, or querynode by sending a crafted HTTP GET request to...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /management/stop handler in the metrics management server on port 9091. An attacker can terminate the proxy, datanode, or querynode by sending a crafted HTTP GET request to...

CVE-2026-11456 Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection

A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxfdumpsystable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-9420

CVE-2026-9420 affects KLiK SocialMediaWebsite 1.0 and is associated with the component handling HTTP GET Request Parameters . The issue is a parameter injection vulnerability in that handler, allowing a remote attacker to exploit it. The threat is supported by public exploitation activity. The CV...

Malicious code in orca-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c52f7fe46d56cb45880942f5266494a2654d9d330914a6c3c99f02045eacd1dc On require/import, index.js collects host identifiers os.hostname, os.userInfo.username, os.platform, os.arch, process.cwd, process.pid, timestamp an...

EUVD-2025-209345

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /urlrule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time, act, rpri, and log...

CVE-2025-50670

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwglbwr.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in the name, qq, and time parameters...

CVE-2025-50671

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /xwglref.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with excessively long strings in parameters name, en, userid, shibiename, time,...

CVE-2026-5531

A vulnerability has been found in SourceCodester Student Result Management System 1.0. Impacted is an unknown function of the file /logincredentials.txt of the component HTTP GET Request Handler. The manipulation leads to cleartext storage in a file or on disk. The attack may be initiated remotel...

CVE-2023-25717

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?loginusername=admin=password$curl substring...

CVE-2018-1000882

WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit...

CVE-2001-1465

SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements...

CVE-2001-1544

Directory traversal vulnerability in Macromedia JRun Web Server JWS 2.3.3, 3.0 and 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the HTTP GET request...

CVE-2021-28936

The Acexy Wireless-N WiFi Repeater REV 1.0 28.08.06.1 Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known default:admin whereas no previous authentication is required...

CVE-2016-10367

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...

CVE-2019-18655

File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the...

CVE-2019-20435

An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API documentation editor page of the API Publisher by sending an HTTP GET request with a harmful docName request parameter...