CVE-2026-76053

TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.3.3 . The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser: WordPress's comment KSES...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate Questo POC usa Spring / Hibernate, tuttavia un approccio simile di rmi - deserializzazione potrebbe essere usato per innescare qualsiasi vulnerabilità di deserializzazione TL;DR root@kitploit: $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain'...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099 - Vulnerabilidade de Injeção SQL no Online-Nurse-Hiring-System v1.0 Autor do Exploit: ugurkarakoc Página do Fornecedor https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Link do Software https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Visão Geral O...

cve-2021-44228-rce-poc

CVE-2021-44228 रिमोट कमांड निष्पादन PoC यह रिपॉज़िटरी सुरक्षा शोधकर्ताओं को रिमोट कोड निष्पादन के साथ प्रयोग करने की अनुमति देती है, जिसमें एक आक्रमण सर्वर का कार्यान्वयन प्रदान किया गया है जो log4j युक्त किसी कमजोर अनुप्रयोग पर एक कस्टम एक्सप्लॉइट लोड करता है। ⚠️ यह उपकरण स्व-मूल्यांकन के लिए है...

semcms

Introdução ao Semcms O SEMCMS é um sistema de gerenciamento de conteúdo CMS para sites de comércio exterior que suporta vários idiomas. root@kitploit: v4.8 Download Link: http://www.sem-cms.com/TradeCmsdown/php/semcmsphp4.8.zip Causas das vulnerabilidades: /xcR45qAdmin/SEMCMSMenu.php Linha 66...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78613

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78612

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78047

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

DEBIAN-CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

DEBIAN-CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2023-1454-EXP

JeecgBoot SQL CVE-2023-1454 exp 1. Dettagli della vulnerabilità La versione 3.5.0 di jeecg-boot presenta una vulnerabilità di SQL injection. La vulnerabilità deriva da un problema di sicurezza nel file jmreport/qurestSql, attraverso il parametro apiSelectId che causa SQL injection. 2. Utilizzo...

electroniz3r

electroniz3r Prendi il controllo dei permessi TCC delle app Electron su macOS con electroniz3r. Lo strumento è stato presentato per la prima volta al DEFCON31 a Las Vegas durante il mio talk ELECTRONizing macOS privacy - a new weapon in your red teaming armory. Panoramica root@kitploit: $...

CVE-2023-23279

SQL injection nel Canteen Management System v1.0. Autore del bug: Tuannq Data di scoperta: 5/1/2023 Fornitore: https://www.sourcecodester.com/php/15688/canteen-management-system-project-source-code-php.html Account di accesso: [email protected]/rootadmin account Super Admin File vulnerabile:...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post Version 1.1.9 - SQL Injection I. Überblick 1. Was ist WordPress? WordPress ist ein Open-Source-CMS Content Management System, ein System zur Verwaltung von Inhalten. Anstatt HTML-Code zu verwenden, wird WP in der Programmiersprache PHP geschrieben...

CVE-2020-17530

CVE-2020-17530 Apache Struts2 è un framework web per lo sviluppo di applicazioni web Java EE. Apache Struts ha divulgato l'8 dicembre 2020 la vulnerabilità di esecuzione remota di codice S2-061 Struts CVE-2020-17530, che potrebbe presentare una vulnerabilità di iniezione di espressioni OGNL in...

CVE-2012-1823---PHP-CGI---RCE

CVE-2012-1823 | Exploit di Esecuzione Remota di Codice RCE su PHP-CGI Un exploit basato su Python per CVE-2012-1823. Questa vulnerabilità consente a un attaccante di eseguire codice arbitrario su un server che esegue una versione vulnerabile di PHP-CGI, iniettando argomenti da riga di comando...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...