11768 matches found
Exploit for Unrestricted Upload of File with Dangerous Type in Avaya Aura_Device_Services
CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device S...
Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os
!imagehttps://github.com/user-attachments/assets/12f20c84-ca7...
Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft
CVE-2024-38063 PoC | DKob & N3TCR4SH Overview This scr...
Exploit for Improper Input Validation in Saleor
saleor-platform All Saleor services started from a single repo...
GHSA-7Q7G-4XM8-89CQ Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
Crafting a very large and well crafted string can increase the CPU usage and crash the program. POC js const ConfigCommentParser = require"@eslint/plugin-kit"; var str = ""; for var i = 0; i 1000000; i++ str += " "; str += "A"; console.log"start" var parser = new ConfigCommentParser;...
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
Crafting a very large and well crafted string can increase the CPU usage and crash the program. POC js const ConfigCommentParser = require"@eslint/plugin-kit"; var str = ""; for var i = 0; i 1000000; i++ str += " "; str += "A"; console.log"start" var parser = new ConfigCommentParser;...
Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php
Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...
GHSA-888J-PJQH-FX58 Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php
Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...
3DPrint Lite < 2.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC Have a logged in admin open an HTML page containing the following form:...
GHSA-HFF8-HJWV-J9Q7 Remote Code Execution on click of <a> Link in markdown preview
Summary There is a vulnerability in Joplin-desktop that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML...
PT-2024-35159 · Craft · Craft
Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.12.2 and 5.4.3 Description: The issue is related to a missing normalizePath in the FileHelper::absolutePath function, which could lead to Remote Code Execution on the server via twig Server Side Template Injection...
Exploit for SQL Injection in Wordpress
CVE-2022-21661 CVE-2022-21661 docker and poc functions.php需要替...
Exploit for Code Injection in Wppa Wp_Photo_Album_Plus
WordPress WP Photo Album Plus Arbitrary Shortcode Execution...
Malicious code in akita-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551f04343832933628b5f36ec11b0f08219b6ad2c16bdc366b56ce2977b5f721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10542 Malicious code in akita-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551f04343832933628b5f36ec11b0f08219b6ad2c16bdc366b56ce2977b5f721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in poc-lelouch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5593904da4697f6d80bea8f6926ba9668d25c9ba34ba801115e347ffc19c719c The OpenSSF Package Analysis project identified 'poc-lelouch' @ 1.6.0 npm as malicious. It is considered malicious because: - The package execut...
MAL-2024-10568 Malicious code in poc-lelouch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5593904da4697f6d80bea8f6926ba9668d25c9ba34ba801115e347ffc19c719c The OpenSSF Package Analysis project identified 'poc-lelouch' @ 1.6.0 npm as malicious. It is considered malicious because: - The package execut...
GHSA-Q78V-CV36-8FXJ Devtron has SQL Injection in CreateUser API
Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...
Devtron has SQL Injection in CreateUser API
Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...