CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection в параметре sSortDir0 - v3.5.2 - v4.5.4. Кроме того, что администратор может использовать эту уязвимость, она также может быть задействована в CSRF-атаке, чтобы обмануть администратора и заставить его выполнить вредоносные запросы. Затронутые файлы...

Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting

Dyn Business Panel WordPress plugin = 1.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter in output, letting attackers execute scripts in the context of high privilege users, exploit requires victim to click a malicious link. id: CVE-2024-130...

Etherpad Lite <1.6.4 - Admin Authentication Bypass

Etherpad Lite before 1.6.4 is exploitable for admin access. id: CVE-2018-9845 info: name: Etherpad Lite 1.6.4 - Admin Authentication Bypass author: philippedelteil severity: critical description: Etherpad Lite before 1.6.4 is exploitable for admin access. impact: | An attacker can bypass the admi...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

Sidekiq < 7.0.8 - Cross-Site Scripting

An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system. id: CVE-2023-1892 info: name: Sidekiq 7.0.8 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: critical description: | An XSS vulnerability on a Sidekiq admin pan...

1Panel SQL Injection - Authenticated

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to...

KevinLAB BEMS (Building Energy Management System) - Backdoor Account

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

i-Panel Administration System 2.0 - Cross-Site Scripting

i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. id: CVE-2021-41878 info: name: i-Panel Administration System 2.0 - Cross-Site Scripting author: madrobot severity: medium...

Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access

Tieline IP Audio Gateway 2.6.4.8 and below is affected by a vulnerability in the web administrative interface that could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. id: CVE-2021-35336 info: name: Tieline IP Audio Gateway =2.6.4.8 -...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

CentOS Web Panel - SQL Injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. id: CVE-2021-31316 info: name: CentOS Web Panel - SQL Injection author: ritikchaddha severity: critical description: | The unprivileged user portal part of CentOS Web Pane...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 Обход MFA WordPress - Лаборатория эксплойта Этот репозиторий предоставляет лабораторию для эксплуатации уязвимости CVE-2024-10924 в WordPress, а именно для обхода двухфакторной аутентификации MFA и получения доступа к панели администрирования WordPress. Предварительные требования...

Linux Distros Unpatched Vulnerability : CVE-2026-89599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicmprobe registers the display before initializing ddata-lock. Once...

cangibrina

/ | | | | / | ' \ / | | ' | '| | ' \ / | | || | | | | | | | | | | | | | | | | | | , || | |, | |./|| | || | |, | |/ Beta - v0.8.7 Поиск панелей управления root@kitploit: Английский Португальский Английский - - - Поиск панелей управления Cangibrina — это кроссплатформенный инструмент, предназначенн...

CVE-2026-89599

A flaw was found in the Linux kernel's fbdev: omapfb: panel-dsi-cm component. The dsicmprobe function registers a display before its associated lock mutex is properly initialized. This timing issue allows another process to attempt to acquire the uninitialized mutex, which could lead to system...

BlackNET

BlackNET 😈 VB.NET を使用して開発された、無料で高度かつモダンな Windows ボットネットで、洗練された安全な PHP パネルを備えています。 BlackNET について 🤓 VB.NET を使用して構築された、無料で高度かつモダンな Windows ボットネットで、洗練された安全な PHP パネルを備えています。 このボットネットコントローラーには多くの機能が搭載されており、無料で最も安全なパネルを利用できます。 開発者: Black.Hacker できること 💪 1. ファイルをアップロード URLから ディスクから 2. DDoS攻撃...

CVE-2023-41362_MyBB_ACP_RCE

CVE-2023-41362 - MyBB ACP RCE CVE-2023-41362에 대한 익스플로잇 블로그 포스트: https://blog.sorcery.ie/posts/mybbacprce...

Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...