FUSE

FUSE FUSE는 제한되지 않은 실행 파일 업로드UEFU 취약점을 식별하도록 설계된 침투 테스트 시스템입니다. 테스트 전략에 대한 자세한 내용은 NDSS 2020에 게재된 논문 "FUSE: Finding File Upload Bugs via Penetration Testing"에 있습니다. FUSE를 구성하고 실행하는 방법은 아래를 참조하십시오. 설정 설치 FUSE는 현재 Ubuntu 18.04 및 Python 2.7.15에서 작동합니다. 1. 종속성 설치 apt-get install rabbitmq-server apt-ge...

CVE-2021-25790-Multiple-Stored-XSS

CVE-2021-25790-다중 저장 XSS: 주택 임대 및 부동산 리스팅 V1.0 소프트웨어의 다중 저장 XSS 링크: https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code https://vulners.com/cve/CVE-2021-25790 https://nvd.nist.gov/vuln/detail/CVE-2021-25790 POC...

self-service-password

LDAP Tool Box Self Service Password 소개 Self Service Password는 사용자가 LDAP 디렉터리에서 자신의 비밀번호를 변경할 수 있게 해주는 PHP 애플리케이션입니다. 이 애플리케이션은 표준 LDAPv3 디렉터리OpenLDAP, OpenDS, ApacheDS, Sun Oracle DSEE, Novell 등 및 Active Directory에서도 사용할 수 있습니다. 다음과 같은 기능이 있습니다: Samba 비밀번호 변경을 위한 Samba 모드 Active Directory 모드 비밀번호...

OWASPWebGoatPHP

WebGoatPHP OWASP WebGoatPHP는 OWASP WebGoat를 PHP 및 MySQL/SQLite 데이터베이스로 포팅한 것입니다. 목표는 챌린지 형태의 레슨을 제공하여 웹 애플리케이션 보안을 위한 대화형 교육 환경을 만드는 것입니다. 각 챌린지에서 사용자는 취약점을 악용하여 해당 주제에 대한 이해를 입증해야 합니다. WebGoatPHP는 단일 모드single mode, 워크숍 모드workshop mode, 콘테스트 모드contest mode, 보안 코딩 모드secure coding mode 등 네 가지 모드를...

exploit-CVE-2017-6090

컨테이너화된 CVE-2017-6090 취약점 이 프로젝트는 CVE-2017-6090에 명시된 원격 코드 실행 취약점을 포함하는 PhpCollab 2.5.1을 실행하는 컨테이너를 빌드합니다. 추가로, 데모를 위해 해당 컨테이너와 mysql을 시작하는 docker-compse 파일이 있으며, 악용 방법은 아래에 있습니다. 빌드 docker build -t 컨테이너이름 . 또는 jlkinsel/exploit-cve-2017-6090 이미지를 사용하세요. 실행 및 구성 이것을 실행하는 가장 쉬운 방법은 포함된...

zentao

zentao Getshell downloadZipPackage 찾기 C:\Users\Jas502n\Desktop\xamppfindstr /s /i "downloadZipPackage" zentao\log.txt:module\client\control.php: $result = $this-client-downloadZipPackage$version, $link; zentao\log.txt:module\client\ext\model\xuanxuan.php:public function downloadZipPackage$version...

CVE-2022-31897

CVE-2022-31897 날짜: 06/22/2022 익스플로잇 작성자: Angelo Pio Amirante 공급업체 홈페이지: https://www.sourcecodester.com/ 소프트웨어 링크: https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html 버전: 1.0 테스트 환경: Server: XAMPP on Windows 10 CVE: CVE-2022-31897 설명: Zoo Management System...

kirjuri

Kirjuri는 더 이상 사용되지 않습니다. Kirjuri가 처리하는 대부분의 사용 사례와 그 이상을 다루는 새 프로젝트를 시작했습니다. 모든 사건 및 증거 관리 요구 사항은 DFIRe 사건 관리 애플리케이션을 확인하세요. 보안 업데이트 2021년 5월 7일 이 프로젝트가 수년간 비활성화되었기 때문에 일부 종속성이 구식이 되는 것은 불가피했습니다. 관련 종속성에는 여러 보안 취약점이 있으며, Twig와 같은 일부 종속성은 최신 버전의 PHP와 호환되지 않습니다. Kirjuri를 설치하고 사용하려면 종속성을 수동으로 업데이트하고...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHPフィルタチェーンによる任意ファイル読み取り プログラムコード PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource=" . $file;...

CVE-2026-86298 SourceCodester Class and Exam Timetabling System delete_subject.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /deletesubject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

PT-2026-86491

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

[SECURITY] Fedora 44 Update: roundcubemail-1.7.3-1.fc44

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

CVE-2026-10227

A vulnerability has been found in raisulislamg4 studentmanagementsystembyphp up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unknown function of the file addusercheck.php of the component User Creation Handler. The manipulation of the argument role leads to sql injectio...

CVE-2026-7716

CVE-2026-7716 describes an SQL injection in the Gym Management System (code-projects) for PHP on Windows NT 1.0, via manipulation of the day parameter in /index.php. The exact vulnerable component and file are /index.php; the root cause is improper handling of user input leading to SQL injection....

📄 School Management System PHP 1.0.0 Cross Site Scripting

School Management System PHP version 1.0.0 suffers from a persistent cross site scripting vulnerability that can lead to administrative account takeover. ==================================================== School Management System PHP - Stored XSS leading to Admin Account Takeover...