JNDI-Injection-Exploit-Plus

JNDI-Injection-Exploit-Plus README in cinese Descrizione JNDI-Injection-Exploit-Plus è uno strumento per generare link JNDI funzionanti e fornire servizi in background avviando server RMI, LDAP e HTTP. Usando questo strumento puoi ottenere link JNDI che puoi inserire nel tuo POC per testare la...

CVE-2022-47966

CVE-2022-47966 POC لـ CVE-2022-47966 الذي يؤثر على منتجات ManageEngine التالية: Access Manager Plus Active Directory 360 ADAudit Plus ADManager Plus ADSelfService Plus Analytics Plus Application Control Plus Asset Explorer Browser Security Plus Device Control Plus Endpoint Central Endpoint Centra...

EUVD-2026-67719

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

CVE-2026-19412

CVE-2026-19412 affects the CP Plus CP-XR-DE21-S Router due to hardcoded HTTP Digest authentication credentials embedded in the firmware, which are identical across all devices running the affected firmware. An attacker with adjacent network access (no privileges required) can obtain these credent...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus Da Subscriber autenticato ad Amministratore tramite l'azione AJAXdo-reinstall 〔 1 〕 Vulnerabilità Causa principale: Ajax::handlerequest registra l'azione AJAX demoimporterplus senza chiamare currentusercan. Qualsiasi subscriber autenticato può inviare...

CVE-2019-10008

CVE-2019-10008 Sequestro de conta privilegiada do ManageEngine Service Desk Plus 9.3 Data: 30-03-2019 Autor do exploit: Ata Hakçıl, Melih Kaan Yıldız Fornecedor: ManageEngine Página do fornecedor:www.manageengine.com Produto: Service Desk Plus Versão: 10.0 Testado em: Windows 10 64 bit CVE :...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus anfällig für Remote Code Execution RCE aufgrund unzureichender Eingabebereinigung Übersicht CVE-2024-21534 ist eine kritische Sicherheitslücke, die in Versionen des jsonpath-plus-Pakets vor Version 10.0.0 gefunden wurde. Die Sicherheitslücke resultiert aus...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: Vulnerabilità di bypass dell'autenticazione durante il login SAML in ServiceDesk Plus. Come descritto da ManageEngine. Se l'installazione di ServiceDesk Plus 11134 presa di mira ha il login SAML abilitato e disponi delle credenziali di un utente con...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Configurazione del laboratorio root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-24358 info: name: Plus Addons for Elementor Page Builder 4.1.10 - Open Redirect...

phpMyChat-Plus 1.98 - Cross-Site Scripting

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. id: CVE-2019-19908 info: name: phpMyChat-Plus 1.98 - Cross-Site Scripting author: madrobot severity: medium description: | phpMyChat-Plus 1.98 contains a cross-site...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

ionCube Tester Plus <= 1.3 - Local File Inclusion

The ionCube Tester Plus plugin for WordPress versions = 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without...

CVE-2021-44077

CVE-2021-44077 Proof of Concept Exploit für CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus msiexec.exe Führen Sie pip install für die Requirements-Datei aus, oder stellen Sie sicher, dass das requests-Paket installiert ist. Wenn Sie eine Reverse Shell empfangen möchten, starten Sie...

Sandboxie

Sandboxie Plus / Classic EN | 中文 Systemanforderungen| Versionshinweise ---|--- Sandboxie ist eine auf Sandboxen basierende Isolationssoftware für Windows-NT-Betriebssysteme, die eine sichere Betriebsumgebung schafft, in der Anwendungen ausgeführt oder installiert werden können, ohne lokale und...

CVE-2022-28219

CVE-2022-28219 PoC für CVE-2022-28219, das ManageEngine ADAudit Plus-Builds 7060 betrifft Technische Analyse Weitere Details in unserem Blog: https://www.horizon3.ai/red-team-blog-cve-2022-28219 Verwendung root@kitploit: % python3 CVE-2022-28219.py -h usage: CVE-2022-28219.py -h -t TARGET -l LHOS...