149 matches found
Log4j-CVE-2021-44228
这个python扫描器将检测java实例中的log4j漏洞并回传响应。...
WordPress <= 6.2 - Server Side Request Forgery
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. id: CVE-2022-3590 info: name: WordPress = 6.2 - Server Side...
pingback
Detección de C2 Pingback Un paquete de Zeek y reglas de Suricata para la detección de túneles de ping ICMP creados por la herramienta C2 Pingback. Entrada de blog complementaria: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Instalación La forma más sencilla de instalar este...
CVE-2022-3590-WordPress-Vulnerability-Scanner
CVE-2022-3590 WordPress漏洞扫描器 此Python脚本用于检查WordPress网站是否存在CVE-2022-3590漏洞。该漏洞利用了WordPress pingback功能中未经认证的盲服务端请求伪造（SSRF）。 开始 这些说明将指导您如何使用此脚本。 截图 前提条件 此脚本需要Python 3和requests库。您可以使用pip安装必要的依赖： pip install -r requirements.txt 用法 您可以通过以下语法从命令行运行脚本： python3 CVE-2022-3590.py -u URL | -f FILE -d DOMAIN...
WordpressPingbackPortScanner
WordpressPingbackPortScanner Wordpress 暴露了一种所谓的 Pingback API，用于链接到其他博客文章。 借助此功能，你可以通过该服务器扫描内联网或互联网上的其他主机。 你还可以将此功能用于某种分布式端口扫描： 你可以使用多个暴露了该 API 的 Wordpress 博客来扫描单个主机。 该问题已在 Wordpress 3.5.1 中修复。旧版本容易受到攻击， 如果 XML-RPC 接口处于活动状态。...
XMLRPC-Pingback-vulnerability-POC
POC de la vulnerabilidad XMLRPC-Pingback Este es mi propio POC escrito sobre la vulnerabilidad xmlrpc-pingback encontrada en wordpress. CVE-2025-54352. Esta vulnerabilidad afecta a wordpress 3.5 hasta la 6.8.2...
WordPress-6.9.1-Blind-SSRF
WordPress-6.9.1-Blind-SSRF 该漏洞没有分配 CVE。 Affected Versions 6.8 - 6.8.3 6.9 - 6.9.1 WordPress = 6.9.1 - 未经身份验证的盲 SSRF（通过 XML-RPC Pingback Discovery）概念验证 PoC Usage 1. 如果尚未安装 requests，请安装 pip install requests 2. 修改代码中的配置变量（例如 WORDPRESSURL、TARGETPOST 和 CALLBACKURL） 3. 执行脚本 python main.py...
CVE-2022-3590-WordPress-Vulnerability-Scanner
CVE-2022-3590 WordPress 漏洞扫描器 此 Python 脚本用于检测 WordPress 网站是否存在 CVE-2022-3590 漏洞。该漏洞利用了 WordPress pingback 功能中未经验证的盲服务器端请求伪造（SSRF）。 开始使用 以下说明将指导您如何使用此脚本。 截图 前提条件 此脚本需要 Python 3 和 requests 库。您可以使用 pip 安装所需的依赖项： pip install -r requirements.txt 使用方法 您可以使用以下语法从命令行运行脚本： python3 CVE-2022-3590.py -u URL ...
Wordpress_cve-2019-9787_defense
Wordpresscve-2019-9787defense 注意 这是由 Sijia Zhanghttps://github.com/sijiahi 和 Bowen Zhouhttps://github.com/KonjakZhou 共同完成的项目。 前提条件： 1 复现攻击： - 在 http://localhost/wp-admin/ 下配置并安装 Wordpress5.0； - 以管理员身份登录 WordPress，并发布至少一篇文章； - 打开 mal.html（需配置在其他域名下，或直接在浏览器中以文件形式打开），点击提交请求（submit request）。 -...
XML-RPC-Pingback-Vulnerability
XML-RPC-Pingback-Vulnerability POC Это мой собственный написанный POC для уязвимости xmlrpc-pingback, обнаруженной в wordpress. CVE-2025-54352. Эта уязвимость затрагивает wordpress с версии 3.5 по 6.8.2...
CVE-2026-7025
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025 Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025 Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
EUVD-2026-25700
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025
Typecho up to 1.3.0 is affected by a server-side request forgery in the Ping Back Service Endpoint: the function Service::sendPingHandle (var/Widget/Service.php). The X-Pingback/link parameter manipulation triggers SSRF, enabling remote access. Exploit publicly available; vendor not responsive to...
typecho 代码问题漏洞
Typecho is a PHP blog platform developed by Typecho’s individual developers. It’s simple yet powerful. Versions of Typecho 1.3.0 and earlier had code vulnerabilities. These vulnerabilities stemmed from improper handling of the X-Pingback/link parameter in the Service::sendPingHandle function with...
PT-2026-35206
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...
CVE-2026-7025: Server-Side Request Forgery (SSRF)
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...