54 matches found
poc-CVE-2019-9053
PoC CVE-2019-9053 - CMS Made Simple SQL注入 用于CVE-2019-9053的Python 3教学PoC，这是CMS Made Simple = 2.2.9中的一个基于时间的盲SQL注入漏洞。 此版本已修改为用于CTF/实验室环境。它包含预配置的前缀以减少提取时间，以及葡萄牙语的解释性信息，帮助学生理解该漏洞利用的工作原理。 警告 本项目仅用于教育目的、受控实验室及CTF环境。 未经明确授权，请勿将此代码用于第三方系统。 本仓库的作者不对该材料的任何滥用行为负责。 漏洞 CVE-2019-9053影响CMS Made...
CVE-2019-9053
CMS Made Simple 通过检查响应延迟逐字符 提取数据。 提取内容： 盐值（cmssiteprefs 表） 管理员用户名（cmsusers 表） 管理员邮箱（cmsusers 表） 管理员密码哈希（cmsusers 表） 可选：使用提供的字典文件和盐值尝试破解提取的哈希。 注意事项 ✅ 完全兼容 Python 3（在 TryHackMe/HTB 工作流中稳定）。 ✅ 可在虚拟环境（venv）中干净地运行。 ✅ 使用彩色输出清晰跟踪进度。 免责声明 本利用脚本仅供教育目的 使用。请勿在未拥有或未获明确授权的系统上使用。 致谢 原始 Python 2 利用脚本：Daniele...
-exploit-lab
-exploit-lab Exploits Python cve-2019-0708 – por HackHeart 🧠 Revisión de código y migración: Python 2 → Python 3 Este exploit fue escrito originalmente en Python 2, que ya no es compatible con los sistemas modernos. Para garantizar la compatibilidad y mantener herramientas a prueba de futuro, se ...
EUVD-2019-2149
Malware in sbrugna...
EUVD-2019-2081
Malware in sbrugna...
EUVD-2018-2113
Malware in sbrugna...
EUVD-2021-30101
Malicious code in bioql PyPI...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
CVE-2024-1528
CMS Made Simple 2.2.14 is reported to be vulnerable to Cross-Site Scripting through /admin/moduleinterface.php due to insufficient encoding of user-controlled input in multiple parameters. The issue is exploitable to deliver a crafted JavaScript payload to an authenticated user, with potential se...
Cross site scripting
Cross Site Scripting XSS vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php...
CVE-2021-43154
Cross Site Scripting XSS vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php...
CVE-2021-43154
CVE-2021-43154 affects CMS Made Simple 2.2.15, with a cross-site scripting (XSS) flaw in the Name field of the Add Category action in moduleinterface.php. The vulnerability stems from insufficient input sanitization/validation in that field, allowing injected scripts to be stored or reflected. Re...
CVE-2020-22842
CMS Made Simple before 2.2.15 allows XSS via the m1mod parameter in a ModuleManager localuninstall action to admin/moduleinterface.php...
CVE-2020-22842
CMS Made Simple (CMSMS) before version 2.2.15 is affected by CVE-2020-22842 due to an XSS vulnerability in the ModuleManager local_uninstall action that processes the m1_mod parameter in admin/moduleinterface.php. The underlying issue is insufficient input validation of this parameter, allowing a...
CVE-2020-14926
CMS Made Simple 2.2.14 is affected by an XSS vulnerability reachable via the Search Term parameter to admin/moduleinterface.php?mact=ModuleManager. The issue stems from inadequate validation of client-side data, per CNVD-2020-60831 and corroborated by multiple feeds. Impact is client-side code ex...
CVE-2020-10681
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1files to admin/moduleinterface.php...
CVE-2020-10681
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1files to admin/moduleinterface.php...
CMS Made Simple <= 2.2.12 Multiple Reflected XSS Vulnerabilities
CMS Made Simple is prone to multiple reflected cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
Design/Logic Flaw
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...