CVE-2022-35405

CVE-2022-35405 Мой пост в блоге Шаблон Nuclei Другая статья ManageEngine PAM360 и Password Manager Pro — неаутентифицированная удалённая уязвимость выполнения кода PoC Access Manager Plus только аутентифицированный :...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: Vulnerabilità RCE in ADSelfService Plus Uno: Descrizione della vulnerabilità ZOHO ManageEngine ADSelfService Plus è una soluzione integrata di gestione self-service delle password e single sign-on per Active Directory e applicazioni cloud dell'azienda ZOHO...

curveball-plus

curveball-plus esperimento di simulazione degli attacchi Curveball CVE-2020-0601 con certificati impliciti ECQV e verificatori in stile Windows Questo file viene aggiornato costantemente!...

CVE-2019-12543

CVE-2019-12543 Zoho ManageEngine ServiceDesk Plus 9.3 XSS-Schwachstelle in PurchaseRequest.do Informationsbeschreibung: In Zoho ManageEngine ServiceDesk Plus 9.3 wurde ein Problem entdeckt. Es liegt eine XSS-Schwachstelle über den Parameter serviceRequestId in PurchaseRequest.do vor. Autor: Conco...

CVE-2019-12542

CVE-2019-12542 Vulnerabilidade XSS no Zoho ManageEngine ServiceDesk Plus 9.3 em SearchN.do Descrição da Informação: Um problema foi descoberto no Zoho ManageEngine ServiceDesk Plus 9.3. Existe XSS através do parâmetro userConfigID do SearchN.do. Autor: Concobe da Tarantula Team - VinCSS membro da...

CVE-2019-12541

CVE-2019-12541 ثغرة XSS في Zoho ManageEngine ServiceDesk Plus 9.3 في SolutionSearch.do وصف المعلومات: تم اكتشاف مشكلة في Zoho ManageEngine ServiceDesk Plus 9.3. توجد ثغرة XSS عبر معامل searchText في SolutionSearch.do. المؤلف: Concobe من فريق Tarantula - VinCSS عضو في Vingroup الحمولة...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 vulnerabilità XSS in SiteLookup.do Descrizione informativa: È stato scoperto un problema in Zoho ManageEngine ServiceDesk Plus 9.3. È presente una XSS tramite il parametro qcsiteID di SiteLookup.do. Autore: Concobe di Tarantula Team - VinCSS...

nginx-cve-2026-42945

CVE-2026-42945 NGINX Rift — scanner difensivo Le organizzazioni che eseguono NGINX Open Source , NGINX Plus o ingress/controller basati su NGINX dovrebbero verificare se sono interessate da CVE-2026-42945 e applicare la patch o riconfigurare prima che i tentativi di sfruttamento raggiungano i...

CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration CVE-2021-31159 यह स्क्रिप्ट ServiceDesk Plus के build 10519 से पहले के संस्करण में पासवर्ड पुनर्प्राप्ति कार्यक्षमता में भिन्न आउटपुट का लाभ उठाती है: यदि उपयोगकर्ता मौजूद है, तो यह एक संदेश लौटाती है जिसमें दावा किया जाता...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 Codice PoC per la vulnerabilità di esecuzione arbitraria di shortcode non autenticata presente nel plugin WordPress WP Photo Album Plus. Dettagli Versioni interessate: = 8.8.08.007 Punteggio CVSS: 7.3 Alto Tipo di...

Golang-CVE-2021-44077-POC

Golang-CVE-2021-44077-POC Dieser Exploit ist eine nicht authentifizierte RCE in Zoho ManageEngine ServiceDesk Plus msiexec.exe Führen Sie dann den Exploit aus. go run CVE-2021-44077.go -u "http://192.168.1.3:8080/" -f "/msiexec.exe" -u ist die verwundbare URL -f ist Ihre schädliche Datei...

CVE-2025-9435

ADManager Plus Build 7230 Elevação de Privilégio CVE-2025-9435 Requisitos Um usuário técnico com a função 'Modificar propriedades gerais do usuário' e acesso de logon ao servidor onde o ADManager está instalado. Descrição Se o usuário técnico tiver direitos de logon no servidor, ele poderá escala...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 Privilegienausweitungs-Schwachstelle Beschreibung Die Rolle „Modify Computers“ ist eine vordefinierte Rolle in ADManager zur Verwaltung von Computern. Wenn ein Techniker-Benutzer über das Recht „Modify Computers“ für einen Computer verfügt, kann er die...

CVE-2024-21534

CVE-2024-21534: Vulnerabilità di Esecuzione Remota di Codice in jsonpath-plus =10.0.7 Riepilogo Questo repository contiene un exploit Proof of Concept PoC per una vulnerabilità critica di Esecuzione Remota di Codice RCE nel pacchetto jsonpath-plus, che interessa le versioni precedenti alla 10.0.7...

CVE-2023-29084

CVE-2023-29084 Iniezione di comandi in ManageEngine ADManager Plus Poc root@kitploit: POST /api/json/admin/saveServerSettings HTTP/1.1 Host: 10.10.10.99:8080 Content-Length: 183 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows N...

CVE-2025-5688-FreeRTOS-Plus-TCP-Out-of-Bounds-Write

CVE-2025-5688 – Exploit di scrittura fuori dai limiti in FreeRTOS-Plus-TCP Corruzione di memoria remota / DoS / potenziale attivazione di RCE in FreeRTOS-Plus-TCP durante l'elaborazione di nomi DNS eccessivamente lunghi nelle query LLMNR o mDNS Buffer Allocation Scheme 1. Autore dell'exploit:...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash Ein verwundbares Ziel antworte...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

AJ-Report < 1.4.1 - Remote Code Execution

AJ-Report before version 1.4.1 is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java code on the victim server through script engine injection in the validation rul...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...