Fortinet FortiOS <=5.2.3 - Cross-Site Scripting

Fortinet FortiOS 5.2.x before 5.2.3 contains a cross-site scripting vulnerability in the SSL VPN login page which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. id: CVE-2015-1880 info: name: Fortinet FortiOS =5.2.3 - Cross-Site Scripting author: pikpikcu...

OURPHP <= 7.2.0 - Cross Site Scripting

OURPHP alertdocument.domain" matchers-condition: and matchers: - type: word part: body words: - "alertdocument.domain...

Ghost CMS <=4.32 - Cross-Site Scripting

Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code. id: CVE-2021-29484 info: name: Ghost CMS =4.32 - Cross-Site...

Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion

A directory traversal vulnerability in the Realtyna Translator comrealtyna component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-2682 info: name: Joomla!...

Joomla! Component BeeHeard 1.0 - Local File Inclusion

A directory traversal vulnerability in the BeeHeard combeeheard and BeeHeard Lite combeeheardlite component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1952 info: name: Joomla! Component BeeHeard 1.0 - Loc...

VMware Aria Operations for Logs - Unauthenticated Remote Code Execution

VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. id: CVE-2023-20864 info: name: VMware Aria Operations for Logs - Unauthenticated Remo...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. id: CVE-2020-17506 info: name: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection author:...

Cacti v1.2.8 - Remote Code Execution

Cacti v1.2.8 is susceptible to remote code execution. This vulnerability could be exploited without authentication if "Guest Realtime Graphs" privileges are enabled. id: CVE-2020-8813 info: name: Cacti v1.2.8 - Remote Code Execution author: gy741 severity: high description: Cacti v1.2.8 is...

Piwigo 13.7.0 - SQL Injection

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...

WordPress Site Editor <=1.1.1 - Local File Inclusion

WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajaxpath parameter to editor/extensions/pagebuilder/includes/ajaxshortcodepattern.php. id: CVE-2018-7422 info: name: WordPress Site Editor =1.1.1 - Local File Inclusion author: LuskaBol,0x240x23elu...

ban-exploitable-bitcoin-nodes

ban-exploitable-bitcoin-nodes Blocca tutti i nodi sfruttabili tramite la vulnerabilità di denial-of-service dal tuo nodo CVE-2018-17144 Requisiti per lo script bash ban.sh Processore JSON da riga di comando jq. Installazione su Linux basato su Debian root@kitploit: sudo apt-get install jq Scarica...

PrintNightmare

PrintNightmare Ecco un progetto che aiuterà a combattere la falla di sicurezza di Windows PrintNightmare! CVE-2021-34527 Devi sapere che Microsoft ha rilasciato una patch per questa falla, ma non è completamente funzionante e contrasta solo l'RCE Remote Code Execution, mentre l'LPE Local Privileg...

Sitecore.Solr-log4j-mitigation

Sitecore.Solr-log4j-mitigation CVE-2021-44228 Questo repository contiene uno script che puoi eseguire sulla tua macchina Windows per mitigare CVE-2021-44228 applicando le indicazioni documentate su https://solr.apache.org/security.htmlapache-solr-affected-by-apache-log4j-cve-2021-44228 Lo script...

cve_2026_frag_family_fix

Mitigazione delle vulnerabilità della famiglia frag / Strumento di mitigazione per la vulnerabilità della famiglia frag Copy Fail 2026 Dirty Frag 2026 Fragnesia 2026 DirtyClone 2026 PEdit-CoW 2026 Esegui la correzione su qualsiasi Linux / Esegui qualsiasi hotfix Linux root@kitploit:...

Log4J-Mitigation-CVE-2021-44228--CVE-2021-45046--CVE-2021-45105--CVE-2021-44832

Mitigazione-Log4J-CVE-2021-44228,CVE-2021-45046,CVE-2021-45105,CVE-2021-44832 Tieni d'occhio questa poiché il team di Apache Log4j sta divulgando molti altri CVE e correggendo problemi di sicurezza molto rapidamente...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigieren Sie log4shell CVE-2021-44228 und CVE-2021-45046 Schwachstellenangriffe mit einem Nginx LUA-Skript Erfordert das aktivierte Nginx lua-Modul https://www.nginx.com/resources/wiki/modules/lua/. Verwenden Sie include /path/to/mitigate-log4shell.conf; im server...

cve-2009-3555-test-server

Cos'è questo? Questo è un server TLS che utilizza un fork fornito in bundle dello stack TLS di Go con l'estensione di indicazione di rinegoziazione forzatamente disabilitata, il che attiverà le mitigazioni per CVE-2009-3555 in OpenSSL 3.0+. Nota che non è realmente vulnerabile a CVE-2009-3555...

chackd

chackd chackd è un demone che randomizza ogni secondo il parametro del kernel tcpchallengeacklimit per prevenire attacchi side-channel Introduzione Un attacco side-channel presentato di recente ha attirato una forte attenzione della comunità 1. Per molti server o dispositivi smartphone questo...