Exploit for Command Injection in Jc21 Nginx_Proxy_Manager

POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the...

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

Online Notice Board System 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Online Notice Board System project 1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozil...

Online Job Recruitment Portal Project 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Online Job Recruitment Portal project v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

ManageEngine DeviceExpert 5.9.7 Build 5970 Hash Disclosure

==================================================================================================================================== | Title : DeviceExpert v 5.9.7 build 5970 PHP extracts Credentials Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

Exploit for Deserialization of Untrusted Data in Ivanti Endpoint_Manager

CVE-2024-29847 PoC for Ivanti Endpoint Manager AgentPortal Des...

Exploit for Improper Input Validation in Ivanti Endpoint_Manager

CVE-2023-28324 POC for CVE-2023-28324 affecting Ivanti EPM...

Exploit for Deserialization of Untrusted Data in Ivanti Endpoint_Manager

CVE-2023-28324 POC for CVE-2023-28324 affecting Ivanti EPM...

Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flaw

Malicious actors are likely leveraging publicly available proof-of-concept PoC exploits for recently disclosed security flaws in Progress Software WhatsUp Gold to conduct opportunistic attacks. The activity is said to have commenced on August 30, 2024, a mere five hours after a PoC was released f...

3DSecure 2.0 3DS Method Authentication Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Method Authentication Tested Versions: 3DSecure 2.0 3DS Method Authentication Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solutio...

Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow

CVE-2024-37084-Poc Setup ,Analysis , Demo exploit and poc abou...

Exploit for Use After Free in Debian Debian_Linux

CVE-2024-26581 Vulnerability Checker for BGN Internal Re...

pyload-ng vulnerable to RCE with js2py sandbox escape

Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...

External Secrets Operator vulnerable to privilege escalation

Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...

Malicious code in ori-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b71bf5ca700406e224508f08266da2a443693d48eb216c3854de6be0d1451346 The OpenSSF Package Analysis project identified 'ori-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes o...

MAL-2024-10226 Malicious code in ori-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b71bf5ca700406e224508f08266da2a443693d48eb216c3854de6be0d1451346 The OpenSSF Package Analysis project identified 'ori-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes o...

GHSA-M8RP-VV92-46C7 gix-path improperly resolves configuration path reported by Git

Summary gix-path runs git to find the path of a configuration file associated with the git installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. Details In gixpath::env, th...

Exploit for Out-of-bounds Write in Mikrotik Routeros

cve-2023-30800-multithread-doser Multithredded DoS Python Scri...

Malicious code in whalebone7-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd207a56329855d7d146895e375b39fcbe907f6ff2e7489a80bbe7c6d4a01fc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-3018 Malicious code in whalebone7-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd207a56329855d7d146895e375b39fcbe907f6ff2e7489a80bbe7c6d4a01fc Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...