CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure

PRTG-Network-Monitor-Information-Disclosure - CVE-2020-11547 Remote unauthenticated user can craft an HTTP request in /public/login.htm or /index.htm by providing the 'type' parameter. Example: http://127.0.0.1/public/login.htm?type=probes replace probes by any of the following to get diferent in...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

SharePointSecurityMonitor

🛡️ SharePoint Security Monitor v5.0 🚀 A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2023-29357 and CVE-2023-33157 protection, intelligent DLL management, advanced threat detection, and automated alerting capabilities. 📋 Table of Contents 🌟 Project Overview ✨ Key...

CVE-2018-19410-POC

CVE-2018-19410-POC Proof of concept for the vulnerability CVE-2018-19410 Details PRTG Network Monitor Version: 18.2.39.1661 and earlier Severity level: High Impact: Authentication Bypass, Improper Authorization, Local File Inclusion Access Vector: Remote The vulnerability permits remote and...

CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentials Dump Author : Javier Carabantes Affected Software : XOne Web Monitor Software : https://xone.es/ Affected Version : 02.10.2024.530 framework 1.0.4.9 Description An unauthenticated SQL injection vulnerability has been discovered in t...

PT-2026-117029

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

Linux Distros Unpatched Vulnerability : CVE-2026-102608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single...

CVE-2026-102608

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

EUVD-2026-103154

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-30971 ZoneMinder: Authenticated RCE via command injection in monitor Device Path

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-30971

ZoneMinder, an open-source CCTV software application, is vulnerable to Remote Code Execution (RCE) via command injection in versions prior to 1.39.2, 1.38.2, and 1.36.40. The root cause is the interpolation of an unvalidated monitor Device field into shell commands within PHP and Perl control pat...

CVE-2026-30971 ZoneMinder: Authenticated RCE via command injection in monitor Device Path

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608

The ZoneMinder CCTV software (prior to version 1.38.3 ) is vulnerable to OS Command Injection in the downloadEvents() function within download_functions.php. The root cause is the manual wrapping of a monitor name in single quotes instead of using escapeshellarg(), allowing shell metacharacters t...

EUVD-2026-102546

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an...

PT-2026-116148

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.39.2 ZoneMinder versions prior to 1.38.2 ZoneMinder versions prior to 1.36.40 Description An authenticated user with monitor-create or monitor-edit permissions can execute arbitrary commands as the web server use...

CVE-2026-84823 Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an...

CVE-2026-84823

A path traversal vulnerability exists in WildFly within the take-snapshot operation. An attacker with the lowest standard Monitor role can manipulate the name parameter to write a copy of the server configuration to an arbitrary location. This allows the user to read sensitive credentials and oth...