CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

CVE-2023-41508

CVE-2023-41508 CVE-2023-41508 - A hard-coded password in Super Store Finder v3.6 allows attackers to access the administration panel. Vulnerability Type Incorrect Access Control Vendor of Product Super Store Finder Affected Product Code Base Super Store Finder - Affected version 3.6 or below. Fix...

codoforum

CVE-2020-5842 Stored XSS Vulnerability in Codoforum 4.8.3 Listed in: Exploit-db, Cve Mitre and The daily swig While I was searching for a free forum software for our community I found Codoforum. After installing it We Vyshnav Vizz tried a few simple XSS payloads to ensure the security and suddenl...

fufu-sec

fufu-sec fufu-sec Framework for Uninvited Frequency Usage is a next-generation WiFi security framework for personal and enterprise wireless auditing. It covers the full attack surface of 802.11 networks from a single browser dashboard. network discovery, handshake capture, PMKID extraction, WPS...

CVE-2023-41362_MyBB_ACP_RCE

CVE-2023-41362 - MyBB ACP RCE Exploit for CVE-2023-41362 Blog post: https://blog.sorcery.ie/posts/mybbacprce...

CVE-2022-42176

PCSecure V5.0.8.xw - Use of Hard-coded Credentials in configuration files leads to admin panel access Summary Vendor: PCTechSoft SAS Product: PCSecure Affected versions: 5.0.8.xw CodeName: PapiQuieroPollo00 Vulnerability Type: Use of Hard-coded Credentials CWE-798 CVSSv3.1 Vector:...

CVE-2021-43789

CVE-2021-43789 Prestashop = 1.7.5.0 1.7.8.2 - SQL injection POC GET /prestashop1.7.8.1/admin860ykaqhn/index.php/sell/orders/?token=tPhFxoTyY8HLoCWbfVDKdY8Io1BVL3ZVebYNljeM9M&orderorderBy=idorder&ordersortOrder= AND SELECT 2331 FROMSELECT COUNT,CONCAT0,MIDIFNULLCASTCURRENTUSER AS...

SecurityNotFound

404 Page Not Found Webshell 📼 Clone me! Clone or download the project: git clone --depth=1 https://github.com/CosasDePuma/SecurityNotFound.git 📦 "Installation" The src/404.php file should be located on the target server and it must have the ability to execute .php files. Here is an example of som...

CVE-2022-36432

CVE-2022-36432 Cross-site Scripting XSS in Preview functionality in Amasty Blog Pro for Magento 2 Description The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by...

CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading ...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 A remote code execution RCE attack allow an attacker run code on a computer. The ability to execute code could lead to deploying additional malware or stealing sensitive data or even harm the server. The remote code execution was discover in Qloapps version 1.6.0.0 whil...

CVE-2020-13889

Author: Andre k Lorenci Contact: [email protected] CVE-2020-13889 Hello, this vulnerability consists in a function called showAlert in the administration panel of bludit,that when accessed in DOM, allows users define the text to be popped up in the message box. But this function dont have an...

cyberpanel

🛠️ CyberPanel Web Hosting Control Panel powered by OpenLiteSpeed, designed to simplify hosting management. 🔧 Features & Services 🔐 Different User Access Levels via ACLs. 🌌 Auto SSL for secure websites. 💻 FTP Server for file transfers. 🕒 Light-weight DNS Server PowerDNS. 🔐 phpMyAdmin to manage...

CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...

CVE-2026-115935

The Craft CMS control panel contains a vulnerability in the app/process-api-response-headers action, allowing authenticated users with accessCp permissions to perform Remote Code Execution (RCE) . An attacker can inject newline characters into the X-Craft-Plugin-Licenses header, which the system ...

Storm-Breaker

A Tool With Attractive Capabilities. Features: Obtain Device Information Without Any Permission ! Access Location SMARTPHONES Access Webcam Access Microphone Update Log: Second latest Update on November 4th , 2022 . The overall structure of the tool is programmed from the beginning and is availab...

CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context SUMMARY PhocaCart 6.1.7 for Joomla stores the raw HTTP User-Agent header from checkout requests in the orders database table...

DWrwq

Descrip PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php. Vulnerability Overview 1.Vulnerability Type: Stored Cross-Site Scripting XSS 2.Affected Product: Online Shopping Portal Project - 2.1 3.Affected Component:...

cve-2020-0688

cve-2020-0688 cve-2020-0688 Login with a user with an email address privliage is nothing to worry about. Grab - VIEWSTATEGENERATOR from page source Grab - the value of ASP.NETSessionId cookie for viewstateuserkey value Download YSO Here ysoserial.exe -p ViewState -g TextFormattingRunProperties -c...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...