CVE-2024-28752

Среда воспроизведения Apache CXF CVE-2024-28752 Уведомление об уязвимости: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Запуск среды samples/javafirstjaxwsfactorybean IDEA Запуск веб-сервиса через ServerStarter.java Сборка Используйте JDK8 mvn clean package java -jar...

WPSniper

WPSniper Детектор CVE-2026-87902 для WordPress Core. getpagetemplate можно направить так, чтобы разрешение шаблона страницы включало читаемый локальный .php-файл за пределами активной темы. WPSniper фингерпринтит сайт, выбирает опубликованный pageid, проверяет класс include и выводит VULN только...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel RCE non authentifiée / |\ \ / /| | | / | | | | || | / | || / | | \ V / | || / / | |/ / | | | | , /| || \ / / | / || /| //||/ || // ||/ /| Exploit pour Pterodactyl Panel ≤ 1.11.10 - LFI non authentifié vers RCE. La vulnérabilité Le point de terminaison...

sshconfig-lint

sshconfig-lint Un seul moteur pour tous les endroits où votre configuration SSH change. sshconfig-lint détecte les erreurs sémantiques dans les configurations client OpenSSH : hôtes en double, chemins d'identité cassés, options dangereuses, algorithmes faibles, ordre des jokers et chaînes Include...

subjack

subjack Scanner de prise de contrôle DNS Subjack est un scanner de prise de contrôle DNS écrit en Go, conçu pour analyser une liste de domaines en parallèle et identifier ceux qui peuvent être détournés. Grâce à la rapidité et à l'efficacité de Go, cet outil se démarque vraiment pour les tests de...

php_filter_chain_generator

Генератор цепочек PHP-фильтров CLI-генератор цепочек PHP-фильтров: получайте RCE без загрузки файла, если вы полностью контролируете параметр, передаваемый в require или include в PHP! Использование Справка $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

CVE-2024-33113

CVE-2024-33113 D-LINK DIR-845L 라우터는 bscsmsinbox.php 파일을 통해 정보가 노출되는 취약점이 존재합니다. CVE-2024-33113은 D-LINK DIR-845L 라우터의 취약점으로, bscsmsinbox.php 파일을 통해 정보가 노출됩니다. 이 취약점은 include 함수의 부적절한 처리로 인해 발생하며, $file 변수를 조작하여 악용될 수 있습니다. 이를 통해 공격자는 임의의 PHP 스크립트를 포함시키고 라우터의 사용자 이름과 비밀번호 같은 민감한 정보를 검색할 수 있습니다. PoC...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 Уязвимость, обнаруженная мной CVE-2019-15053 Консультация: advisory.txt Основная информация Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Test...

cve-2022-31692

Démo CVE-2022-31692 Aperçu Une simple application Spring Boot démontrant une configuration vulnérable à CVE-2022-31692. Cette vulnérabilité peut attirer l'attention en raison de sa sévérité - elle a un score de base CVSS 3.x de 9,8 car elle permet de contourner l'authentification. Le but de ce...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Неаутентифицированная SQL-инъекция через meclistloadmore attsinclude / attsexclude Краткое описание Деталь| Значение ---|--- Плагин| Modern Events Calendar Lite Slug| modern-events-calendar-lite Автор| Webnus Затронутые версии| = 7.33.0 текущая...

CVE-2020-13886

PoC: https://youtu.be/nNKBRx8IglI ------------------------------------------------------------------------------------------------------------- ------------- 0day: IP-телефон TIP200/200 LITE & TIP 300 | Local File Include | ---------------------------- ------------------------------- Автор P0c:...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364 : Exploitation SSRF vers LFI via XOP:Include dans Apache CXF MTOM ⚠️ AVERTISSEMENT CET OUTIL EST UNIQUEMENT DESTINÉ À DES TESTS DE SÉCURITÉ ÉDUCATIFS ET AUTORISÉS Ce proof-of-concept est fourni à des fins éducatives pour aider les professionnels de la sécurité à comprendre la...

CVE-2024-33113

CVE-2024-33113 Le routeur D-LINK DIR-845L est vulnérable à une divulgation d'informations via le fichier bscsmsinbox.php. La CVE-2024-33113 est une vulnérabilité dans le routeur D-LINK DIR-845L qui permet une divulgation d'informations par le biais du fichier bscsmsinbox.php. La vulnérabilité...

CVE-2026-105226

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible...

EUVD-2026-92250

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible...

CVE-2026-105226 osCommerce osCommerce2 Newsletter Management newsletters.php include code injection

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible...

EUVD-2026-92249

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULEPAYMENTINSTALLED leads to code injection. The attack can be executed remotely...