Lucene search
+L

10869 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.82 views

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

9.8CVSS8.2AI score0.97193EPSS
SaveExploits6References5
Kitploit
Kitploit
added 2026/09/20 1:27 a.m.8 views

CVE-2025-10720-PoC

描述 该概念验证(PoC)描述了在 WordPress 插件 WP Private Content Plus v3.6.2 中发现的一个认证绕过漏洞。该问题允许未认证用户绕过受密码保护的内容,原因在于不恰当地依赖客户端 Cookie。 详情 漏洞类型 :认证绕过(未认证) CWE-ID :CWE-565 - 依赖未经验证和完整性检查的 Cookie 影响 成功利用允许未认证用户访问插件全局密码功能保护的内容。 参考 视频演示 WPScan 受影响插件...

6.5CVSS5.8AI score0.00297EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/19 4:56 p.m.11 views

CVE-2025-9435

ADManager Plus Build 7230 权限提升 CVE-2025-9435 要求 一个拥有"修改用户常规属性"角色的技术人员用户,并且能够登录到安装了ADManager的服务器。 描述 如果该技术人员用户拥有对服务器的登录权限,则可以将权限提升至运行ADManager的高权限服务帐户或用户帐户。用户可以通过Web应用程序创建任意目录,然后将DLL文件复制到该目录中。当ADManager重启时,该DLL文件将以运行ADManager的用户的权限执行。 概念验证 1. 以技术人员用户身份登录,点击"配置文件属性"。 2...

5.5CVSS6.1AI score0.00602EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/19 3:22 p.m.9 views

CVE-2019-12541

CVE-2019-12541 Vulnerabilidad XSS en Zoho ManageEngine ServiceDesk Plus 9.3 en SolutionSearch.do Descripción de la información: Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro searchText de SolutionSearch.do. Autor: Concobe del equipo Tarantula -...

6.1CVSS6.4AI score0.10846EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/19 2:12 p.m.14 views

curveball-plus

curveball-plus 模拟实验:在ECQV隐式证书和类Windows验证器下的Curveball(CVE-2020-0601)攻击 此文件会不断更新!...

8.1CVSS7.5AI score0.89436EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/19 9:31 a.m.22 views

CP-PLUS-EZ-P21-CVE-2026-65893-65894

🔐 CP PLUS EZ-P21 网络摄像机安全分析 CVE-2026-65893 CVE-2026-65894 任意代码执行与身份验证不当 – CP PLUS EZ-P21 网络摄像机 概述 本仓库记录了在 CP PLUS EZ-P21 网络摄像机 中发现的两个安全漏洞。该摄像机是一款基于 IP 的监控摄像头,用于视频监控以及通过网络访问摄像机功能和快照。 这两个问题均已通过负责任披露 流程处理,经厂商/CERT 流程协调,并分配了相应的 CVE 标识符。 漏洞摘要 1. CVE-2026-65893 — 任意代码执行 该漏洞源于固件中启用的不安全调试功能。拥有物理访问权限...

8.7CVSS6.6AI score0.004EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/19 3:17 a.m.11 views

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/19 2:36 a.m.13 views

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 在SiteLookup.do中的XSS漏洞 信息描述:在Zoho ManageEngine ServiceDesk Plus 9.3中发现一个问题。通过SiteLookup.do的qcsiteID参数存在XSS漏洞。 作者:Tarantula团队 - VinCSS(Vingroup成员)的Concobe Payload...

6.1CVSS6.4AI score0.10846EPSS
SaveExploits5
CVE
CVE
added 2026/09/19 2:27 a.m.27 views

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

7.5CVSS0.00525EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/19 2:27 a.m.38 views

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 2:27 a.m.8 views

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/19 2:16 a.m.8 views

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus 版本 4.3.3 在 Windows 10 上的认证绕过 PoC。 影响所有 Windows 版本 PoC 视频 复现步骤 1. 断开与企业网络的连接 2. 连接到自己的热点 3. 点击重置密码;如果在内网托管了密码重置 Web 应用程序,厚客户端浏览器应报 404 错误 4. 点击搜索该站点,应打开一个新的 Internet Explorer 窗口 5. 按 Ctrl S 打开资源管理器,浏览到...

7.2CVSS6.7AI score0.01413EPSS
SaveExploits2References1
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.105 views

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

9.8CVSS8.6AI score0.9896EPSS
SaveExploits8References5
Patchstack
Patchstack
added 2026/09/18 2:54 p.m.4 views

WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability

Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...

7.5CVSS0.00525EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/09/18 6:16 a.m.7 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/18 6:16 a.m.10 views

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

7.5CVSS0.01062EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/18 5:41 a.m.8 views

EUVD-2026-82656

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/18 5:41 a.m.37 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/18 5:41 a.m.42 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...

7.7CVSS0.015EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/18 5:37 a.m.10 views

EUVD-2026-82655

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

7.5CVSS0.01062EPSS
SaveExploits0References1
Rows per page
Query Builder