MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

Blue Angel Software Suite (5V Technologies) - OS Command Injection

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter ATA and Voice over IP VoIP devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the pingaddr parameter to...

Chamilo model.ajax.php - SQL Injection

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. id: CVE-2021-34187 info: name: Chamilo model.ajax.php - SQL Injection author: DhiyaneshDK severity: critical description: | main/inc/ajax/model.ajax.php in Chamilo...

Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloudcontrol.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a...

TOTOLINK A3700R - Command Injection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. id: CVE-2023-46574 info: name: TOTOLINK A3700R - Command Injection author: DhiyaneshDk severity: critical description: | An issue in...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2022-RCE

CVE-2022-XXXX Reverse Müll-Daten-Injektion CVE-Abonnement Werkzeuge Ausnutzung Tutorial Exploit POC RCE LOG4j Deserialisierung JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-20559...

kwetza

Introduction By Chris Le Roy @brompwnie [email protected] Kwetza is a tool that allows you to infect an existing Android application with a Meterpreter payload. What does it do? Kwetza infects an existing Android application with either custom or default payload templates to avoid detection ...

kwetza

Einführung Von Chris Le Roy @brompwnie [email protected] Kwetza ist ein Werkzeug, mit dem Sie eine bestehende Android-Anwendung mit einem Meterpreter-Payload infizieren können. Was macht es? Kwetza infiziert eine bestehende Android-Anwendung entweder mit benutzerdefinierten oder...

rtl8812au

RTL8812AU/21AU und RTL8814AU Linux-Treiber mit Monitor-Modus und Frame-Injektion Der Master-Zweig basiert auf https://github.com/ulli-kroll/rtl8821au Branch v4.3.22-beta/rework. Laut rtwversion.c ist die tatsächliche Treiberversion 4.3.20. Der Branch v4.3.21 kann für RTL8814AU- oder...

CVE-2021-26084

CVE-2021-26084 Proof of Concept für CVE-2021-26084. Confluence Server Webwork OGNL-Injection Pre-Auth RCE Haftungsausschluss Dies dient ausschließlich zu Bildungszwecken. Ich bin nicht für deine Handlungen verantwortlich. Nutzung auf eigene Gefahr. Befehlseinschränkungen Aufgrund des Payloads ist...

google-dorks-bug-bounty

Google Dorks für Bug Bounty Eine Liste von Google Dorks für Bug Bounty, Web Application Security und Pentesting Live-Tool Breite Domain-Suche mit Negativsuche site:example.com -www -shop -share -ir -mfa PHP-Erweiterung mit Parametern site:example.com ext:php inurl:? API-Endpunkte site:example.com...

Blackbone

Blackbone Biblioteca de hacking de memória Windows Funcionalidades Suporte para x86 e x64 Interação com processos Gerenciar PEB32/PEB64 Gerenciar processo através da barreira WOW64 Memória do processo Alocar e liberar memória virtual Alterar proteção de memória Ler/Escrever memória virtual Módulo...

social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - Gespeichertes Cross-Site-Scripting XSS Betroffene Version: InstantCMS 2.16.3 Schritte zur Reproduktion: 1. Melden Sie sich unter https://demo.instantcms.io als Demo-Benutzer an. 2. Besuchen Sie https://demo.instantcms.io/photos/upload. 3. Laden Sie das Bild mit dem...

llm-prompt-injection-resources

llm-prompt-injection-resources Uma coleção curada de recursos para aprender e pesquisar ataques de injeção de prompt em LLMs, defesas e segurança. Doar Apoie a manutenção deste projeto com PayPal ou escaneando o código QR abaixo...

Log4Shell-CVE-2021-44228-ENV

Log4Shell-Reproduktionsumgebung Beispielbeschreibung IP des Zielrechners: 47.47.47.47 IP des Angreiferrechners: 48.48.48.48 Docker mit verwundbarem Dienst auf dem Zielrechner ausführen Docker-Image mit DockerFile bauen und ausführen: docker build . -t vuln docker run -p 8080:8080 --name vuln vuln...

CVE-2016-6662

CVE-2016-6662 Von SQL-Injection zu Root-Shell mit CVE-2016-6662 von MaYaSeVeN Proof of Concept: https://www.youtube.com/watch?v=lyc7GFE3q2U...

HavocPwn

Havoc-PWN Autenticado Esta cadeia SSRF-RCE foi inspirada no SSRF POC CVE-2024-41570 do chebuya e no Havoc Auth RCE do IncludeSecurity. Ambos os exploits são incríveis e bem elaborados, por favor, dêem o devido reconhecimento a estes criadores pelo seu trabalho árduo! chebuya hyperreality Como...