10865 matches found
Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...
CVE-2025-10720-PoC
Description This proof of concept PoC describes an authentication bypass vulnerability found in the WordPress plugin WP Private Content Plus v3.6.2. The issue allows unauthenticated users to bypass password-protected content due to improper reliance on client-side cookies. Details Vulnerability...
CVE-2025-9435
ADManager Plus Build 7230 Повышение привилегий CVE-2025-9435 Требования Пользователь-техник с ролью 'Modify user general properties' и доступом для входа на сервер, где установлен ADManager. Описание Если пользователь-техник имеет права входа на сервер, он может повысить свои привилегии до уровня...
CVE-2019-12541
CVE-2019-12541 XSS-уязвимость в Zoho ManageEngine ServiceDesk Plus 9.3 в SolutionSearch.do Описание проблемы: Проблема была обнаружена в Zoho ManageEngine ServiceDesk Plus 9.3. Существует XSS через параметр searchText в SolutionSearch.do. Автор: Concobe из Tarantula Team - VinCSS член Vingroup...
curveball-plus
curveball-plus эксперимент по моделированию атак Curveball CVE-2020-0601 с использованием неявных сертификатов ECQV и верификаторов, подобных Windows Этот файл постоянно обновляется!...
CP-PLUS-EZ-P21-CVE-2026-65893-65894
🔐 Анализ безопасности IP-камеры CP PLUS EZ-P21 CVE-2026-65893 CVE-2026-65894 Произвольное выполнение кода и некорректная аутентификация – IP-камера CP PLUS EZ-P21 Обзор В этом репозитории задокументированы две уязвимости, обнаруженные в IP-камере CP PLUS EZ-P21 — IP-камере видеонаблюдения,...
CVE-2026-87909
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...
CVE-2019-12538
CVE-2019-12538 Уязвимость XSS в Zoho ManageEngine ServiceDesk Plus 9.3 в SiteLookup.do Описание информации: В Zoho ManageEngine ServiceDesk Plus 9.3 обнаружена проблема. XSS возможен через параметр qcsiteID в SiteLookup.do. Автор: Concobe из Tarantula Team - VinCSS участник Vingroup Полезная...
CVE-2026-87909
The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...
CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...
EUVD-2026-83471
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...
CVE-2019-12476
ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus version 4.3.3 PoC for an authentication bypass on Windows 10. Affects all versions of Windows PoC Video Steps to repoduce 1. Disconnect from your enterprise network 2. Connect to your own hotspot 3. Click on reset password; the thick client...
Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution
Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...
WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability
Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18911
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...
EUVD-2026-82656
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18912
ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...