11768 matches found
Exploit for OS Command Injection in Php
CVE-2024-4577 RCE Exploit While implementing PHP, the team d...
Exploit for Code Injection in Ejs
THM Challenge: SSTI RCE...
Sysax Multi Server 6.99 Cross Site Scripting
Exploit Title: Sysax Multi Server 6.99 - Reflected XSS Date: 2024-11-03 Exploit Author: Yehia Elghaly Mrvar0x Vendor Homepage: https://www.sysax.com/ Software Link: https://www.sysax.com/download/sysaxservsetup.msi Version: MultiServer 6.99 Tested on: Windows 10 x64 Reflected XSS - Affected...
Exploit for CVE-2024-51132
CVE-2024-51132-POC Vulnerability Type XXE - XML Externa...
Exploit for Untrusted Search Path in Yandex Yandex_Browser
CVE-2024-6473 PoC Yandex Browser for Desktop before 24.7...
Path traversal in oak allows transfer of hidden files within the served root directory
Summary By default oak does not allow transferring of hidden files with Context.send API. However, this can be bypassed by encoding / as its URL encoded form %2F. Details 1. Oak uses decodeComponent which seems to be unexpected. This is also the reason why it is not possible to access a file that...
Exploit for SQL Injection in Ultimatemember Ultimate_Member
CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof o...
Exploit for Missing Authentication for Critical Function in Cyberpanel
CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...
Exploit for OS Command Injection in Cyberpanel
CyberPanel Command Injection Vulnerability - CVE-2024-51378...
UP-RESULT PRO 1.0 SQL Injection
Titles: UP-RESULTpro-1.0 Multiple-SQLi Author: nu11secur1ty Date: 10/28/2024 Vendor: https://mayurik.com/ Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download Reference:...
Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)
Summary Usage of the Butterfly.prototype.parseJSON or getJSON functions on an attacker-controlled crafted input string allows the attacker to execute arbitrary JavaScript code on the server. Since Butterfly JavaScript code has access to Java classes, it can run arbitrary programs. Details The...
GHSA-87CF-J763-VVH8 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
Summary In the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Details The...
OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand
Summary The export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then ...
OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
Summary The /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as...
Exploit for Deserialization of Untrusted Data in Microsoft
CVE-2022-41082 This repository contains a proof-of-concept P...
CISA Warns of Active Exploitation of Microsoft SharePoint Vulnerability (CVE-2024-38094)
A high-severity flaw impacting Microsoft SharePoint has been added to the Known Exploited Vulnerabilities KEV catalog by the U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday, citing evidence of active exploitation. The vulnerability, tracked as CVE-2024-38094 CVSS score: 7.2,...
The severity of the Elevation of Privilege – Windows Kernel-Mode Driver (CVE-2024-35250) vulnerability has increased
The severity of the Elevation of Privilege - Windows Kernel-Mode Driver CVE-2024-35250 vulnerability has increased. This vulnerability was fixed as part of the June Microsoft Patch Tuesday. As in the case of the CVE-2024-30090 vulnerability, it was discovered by a researcher with the nickname...
GHSA-3VPC-4P9P-47HC curl_cffi bundles a version of libcurl affected by High Severity vulnerability
Summary curlcffi is potentially affected by High Severity vulnerability CVE-2023-38545 in libcurl=8.5, which is not affected by this issue...
The severity of the Elevation of Privilege – Microsoft Streaming Service (CVE-2024-30090) vulnerability has increased
The severity of the Elevation of Privilege - Microsoft Streaming Service CVE-2024-30090 vulnerability has increased. The vulnerability was fixed as part of the June Microsoft Patch Tuesday. At that time, no one highlighted this vulnerability. The vulnerability was discovered by a researcher with...