log4j-vulnerability

Log4Shell CVE-2021-44228 is a zero-day vulnerability in Log4j Log4J Vulnerability Discovered: 24th November 2021 Patched: 6th December 2021 Attack Demo Click below for youtube video Sample application This sample application is spring boot application, and is using log4j as a logging framework, a...

log4shell-mitigation

Details and Mitigation Strategy for log4j2 RCE Vulnerability Visit this Youtube video for additional details. https://youtu.be/jqWdwTeGRK0 This is a quick post on the mitigation for CVE-2021-44228 Security Vulnerability aka Log4Shell and LogJam found in log4j2 Disclaimer All the information and...

java-log4j-cve-2020-9488

java-log4j-cve-2020-9488 Demo of CVE-2020-9488: Unsafe logging with Log4j and remediation...

CVE-2025-10377

Proof of Concept CVE-2025-10377 Cross-Site Request Forgery CSRF in Plugin System Dashboard Funtion sdtogglelogs Vulnerability Type: Cross-Site Request Forgery CSRF Affected Function: sdtogglelogs CVSS v3.1: 4.3 Medium Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Note: Score reflects unauthorized...

Log4j_CVE-2021-44228

Log4j CVE-2021-44228 Solutions Think about if you actually really require Log4j2 Core. Most likely, your own code or some 3rd-party library you depend on only need Log4j's Logging API façade - but can log to another back-end. You could therefore simply completely exclude the...

CVE-2022-4539

Usage Considerations: Adaptability: You can easily modify the payloads, IP generation logic, and proxies to match different scenarios or environments. Ethical Use: Ensure you have explicit permission before testing any system with this code. Scalability: This code is designed to be scalable and...

CVE-2019-17571

CVE-2019-17571 / Apache Log4j 1.2.X Deserialization Remote Code Execution Vulnerability Vulnerability warning reference link: https://mp.weixin.qq.com/s/okU2y0izfnKXXtXG3EfLkQ 1. Vulnerability Description Apache Log4j is a Java-based open-source logging tool developed by the Apache Software...

CVE-2026-93889

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wpmailfailed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-91957

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wpmailfailed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-93889 Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wpmailfailed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EventLogging

Notice This repo is no longer maintined as of April 2024 BHIS Notice This repo is no longer maintined as of April 2024 EventLogging This repo contains guidance on setting up event logging. This guidance is broken up into sections, Defensive Readiness Condition DEFCON, and intended to be applied...

CVE-2026-93889: Improper Neutralization of Input During Web Page Generation

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wpmailfailed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2022-23305_POC

CVE-2022-23305 Log4j JDBCAppender sql injection POC This is a very simple Spring Boot based application that demonstrates the CVE-2022-23305 vulnerability. It uses Apache Maven, Spring Boot, Spring MVC, and the H2 in-memory database to log one simple entry, taken as a URL query string parameter...

CVE-2026-94594

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

ndaal_public_auditd

Лучшие практики и развёртывание Linux Audit Daemon Auditd Этот репозиторий содержит исчерпывающие лучшие практики для настройки и развёртывания Linux Audit Daemon Auditd, включая обширный набор правил аудита, ориентированных на безопасность, роль Ansible для автоматизированного развёртывания и...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

CVE-2026-103426

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Log4Shell-CVE-2021-44228-Demo

CVE-2021–44228 Demo 1. CVE-2021–44228 Introduction At the end of 2021, the biggest news in the cybersecurity world was the Log4j vulnerability, numbered CVE-2021-44228, also known as Log4Shell. In the CVSS vulnerability scoring system, it was rated the most severe 10 out of 10 , and it is also...

CVE-2026-103426

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.31.4 . The vulnerability exists because of insufficient input sanitization and output escaping of the '_rt' parameter . An unauthenticated attacker can inject arbit...