CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: Iniezione CSV in Instant Developer Foundation 25.0.9600 – Prova di concetto PoC 📌 Panoramica Questo repository contiene una prova di concetto PoC per una vulnerabilità di iniezione CSV Formula Injection CVE-2025-60852 che interessa le applicazioni realizzate con il framework Insta...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Scrittura Arbitraria di File + Iniezione XML → Esecuzione Remota di Codice Indice Panoramica Dettagli della vulnerabilità Catena di attacco Requisiti Installazione Configurazione Utilizzo Come funziona Codice vulnerabile Checklist pre-sfruttamento...

CVE-2022-39073

CVE-2022-39073 Dettagli del firmware: root@kitploit: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisiti requests pip install requests Iniezione di comandi La vulnerabilità è un'iniezione di comandi condivisa tra il binario ztenetlinkdetect e il gestore...

CVE-2022-39066

CVE-2022-39066 Firmware-Details: root@kitploit: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Voraussetzungen requests pip install requests SQL-Injection Die Schwachstelle ist eine SQL-Injection im Handler PHONEBLOCKADD im Webserver-Binary goahead. Mögliche...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to SQL Injection vulnerability in Dashboard UI (CVE-2025-36368)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed SQL Injection vulnerability Vulnerability Details CVEID:CVE-2025-36368 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, and 6.2.1.0 through...

sqlmap-ai

Assistente de IA para SQLMap Um wrapper com tecnologia de IA em torno do SQLMap que torna os testes de injeção SQL mais acessíveis e automatizados. Recursos Recursos Principais Testes Assistidos por IA - Análise inteligente de vulnerabilidades e recomendações Testes Adaptativos - Testes passo a...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : Prova di concetto Prova di concetto per la CVE-2022-39227. Secondo questa CVE, esiste una falla nella verifica dei JSON Web Token. Con un token valido è possibile riutilizzare la sua firma con claim modificati. Requisiti: 1. Un JSON Web Token valido. 2. Il backend...

CVE-2018-20718

CVE-2018-20718 Dies ist ein POC für CVE-2018-20718. Es handelt sich um eine PHP-Object-Injection-Schwachstelle. Die Schwachstelle betrifft alle Versionen von Pydio vor 8.2.1 und führt zu Unauthenticated Remote Code Execution. Sie wurde ursprünglich von RIPS gefunden. Ich habe ein Gadget in...

log4j2-rce-poc

Log4j2 RCE-Schwachstellen-POC Ein minimaler Proof-of-Concept für die Log4j2-JNDI-Remote-Code-Execution-Schwachstelle CVE-2021-44228. Er ist für Bildungszwecke gedacht, um Menschen, die keine Sicherheitsforscher sind, zu helfen zu verstehen, wie sie funktioniert und wie groß die Auswirkungen sind...

DataInject-BOF

Data Inject BOF Uma implementação de beacon object file do proof-of-concept de injeção de processo do meu post no blog Control Flow Hijacking via Data Pointers. Sequestra o fluxo de controle sobrescrevendo os ponteiros de função do Control Flow Guard da combase.dll chamados pelas funções de proxy...

CVE-2026-31156

CVE-2026-31156 Esiste una vulnerabilità di path injection in OpenPLC-v3, che deriva dal fatto che il programma non esegue alcun controllo di validità sui parametri del percorso file passati dalla riga di comando. Gli attaccanti possono leggere qualsiasi file leggibile costruendo percorsi malevoli...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-67397

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-76053

TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.3.3 . The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser: WordPress's comment KSES...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate Questo POC usa Spring / Hibernate, tuttavia un approccio simile di rmi - deserializzazione potrebbe essere usato per innescare qualsiasi vulnerabilità di deserializzazione TL;DR root@kitploit: $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain'...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099 - Vulnerabilidade de Injeção SQL no Online-Nurse-Hiring-System v1.0 Autor do Exploit: ugurkarakoc Página do Fornecedor https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Link do Software https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Visão Geral O...

cve-2021-44228-rce-poc

CVE-2021-44228 रिमोट कमांड निष्पादन PoC यह रिपॉज़िटरी सुरक्षा शोधकर्ताओं को रिमोट कोड निष्पादन के साथ प्रयोग करने की अनुमति देती है, जिसमें एक आक्रमण सर्वर का कार्यान्वयन प्रदान किया गया है जो log4j युक्त किसी कमजोर अनुप्रयोग पर एक कस्टम एक्सप्लॉइट लोड करता है। ⚠️ यह उपकरण स्व-मूल्यांकन के लिए है...

semcms

Introdução ao Semcms O SEMCMS é um sistema de gerenciamento de conteúdo CMS para sites de comércio exterior que suporta vários idiomas. root@kitploit: v4.8 Download Link: http://www.sem-cms.com/TradeCmsdown/php/semcmsphp4.8.zip Causas das vulnerabilidades: /xcR45qAdmin/SEMCMSMenu.php Linha 66...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78612

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...