Joomla! Harmis Messenger 1.2.2 - Local File Inclusion

Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. id: CVE-2019-9922 info: name: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion author: 0xAkoko severity: high description: Joomla! Harmis Messenger 1.2.2 is...

Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 におけるSQLインジェクション経由のRCE BigAnt MessengerのSQLインジェクションの脆弱性により、RCEの脆弱性が発生します。以下の手順に従って悪用してください。 使用方法: root@kitploit: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST Target IP address -p,...

stegcloak

StegCloak The Cloak of Invisibility for your texts StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting the secret before cloaking it with special unicode invisible characters. It can be used to...

CVE-2022-26629

Lock Screen Bypass CVE-2022-26629 影響を受ける製品 SoroushPlus+ Messenger 1.0.30 脆弱性の種類 不適切なアクセス制御 影響 ロック画面バイパス 概要 不十分な権限および特権の不適切な処理により、攻撃者はロック画面の機能を変更・上書きでき、いかなる認可もなしにロック画面をバイパスすることが可能になります。 悪用 BypassLockScreen.py 自動エクスプロイト PoC 1. BypassLockScreen.py をお使いの SoroushPlus+ インストールディレクトリに配置し、 2. Python3...

CVE-2025-49091-Gajim-RCE

CVE-2025-49091 - Python 概念验证 针对 Gajim 加密即时通讯软件的 CVE-2025-49091 概念验证（PoC）漏洞利用程序。 由 Patryk Ptak（SivertPL）和 Dennis Dast 独立发现，漏洞利用程序由 Patryk Ptak 编写。 文件 CVE-2025-49091.py —— Python 概念验证脚本。 使用方法 root@kitploit: python3 CVE-2025-49091.py 根据需要调整脚本中的必需参数或配置。 免责声明 本仓库仅用于教育目的...

hermes-the-messenger

Hermes the messenger Windows でプッシュ通知を介して永続化を実現する PoC 技術的な詳細と背景については、こちらのブログ記事をお読みください: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence 使い方 何はともあれ、Azure のセットアップが必要です。次に、プッシュ通知のために自身を登録するため、実行可能ファイルを一度実行する必要があります。引数として Azure アプリのオブジェクト ID...

exploits

exploits 公開済みのPoCは exploitdb.com で見つけることができます Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

voron-crypto

Voron 暗号/プロトコルライブラリ — レビュー依頼 これは小規模なE2EEメッセンジャープロジェクトの暗号およびメッセージングプロトコルの中核部分であり、外部レビューのために単体として切り出されたものです。これは製品全体ではありません — Androidクライアントとデプロイ設定は意図的に除外されています。ここにあるのは、レビューが必要な部分だけです。 ここに含まれるもの common/ — ライブラリ本体: e2ee/ — X3DH-lite（非同期鍵合意）+ その上にDouble...

cve-2020-27358-27359

CVE-2020-27358 / CVE-2020-27359 CVE-2020-27358 和 CVE-2020-27359 的利用步骤 CVE-2020-27358 在 REDCap 8.11.6 至 9.x（10 之前）版本中发现了一个问题。Messenger 的 CSV 功能（允许用户将其对话线程导出为 CSV）允许非特权用户通过更改发送至端点 Messenger/messengerdownloadcsv.php?title=Hey&threadid=THREADID 的请求中的 threadid 参数，来导出彼此之间的对话线程。 测试步骤 1. 以任意用户身份登录。 2...

EUVD-2026-70850

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall (CSF) by WebPros maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host . A remote unauthenticated attacker whose address is blocked by CSF can request a mapped executable and run arbitrary commands as the Apa...

PT-2026-85316

Name of the Vulnerable Software and Affected Versions ConfigServer Security & Firewall versions prior to 16.31 Description An insecure Apache configuration maps /usr/bin as CGI Common Gateway Interface programs through the Messenger v3 HTTPS virtual host. This allows a remote unauthenticated...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: fixed invalid accesses to cephconnectionv1info. There is a place where generic code in messenger.c reads from certain fields, and another place where it writes to members of the con-v1 union without checking that those...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the net/ceph/messengerv2.c file within the Linux kernel before version 6.4.5. There is an integer signedness error, which leads to a buffer overflow and remote code execution via the HELLO command or one of the AUTH frames. This occurs due to an untrusted length value...

The vulnerability of the process_v2_sparse_read() function in the net/ceph/messenger_v2.c kernel module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the processv2sparseread function in the net/ceph/messengerv2.c kernel module of the Linux operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

DEBIAN-CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...