CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

EUVD-2026-68460

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...

EUVD-2026-68459

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82678 diem-project diem Administrative Console actions.class.php executeCommand os command injection

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...

CVE-2026-82678

diem-project diem (up to 5.1.3 ) contains an OS command injection vulnerability in the Administrative Console component. The affected element is the executeCommand function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php , where manipulation of the dm_command argument allows command ...

projet-secu

このリポジトリには README がありません。...

fusee-toy

这个仓库包含了fusee-toy项目的源代码，它是我对CVE-2018-6242（又名Fusée Gelée，又名shofel2）的基本实现。该项目写于2021年1月，旨在加深我对这个漏洞的理解。 此实现参考了fusee-nano和fusee-launcher项目。它被构建为在现代Linux环境下工作。...

pev

readpe pev は @mentebinaria/readpe に移動し、新しいメンテナーが加わりました。:...

Folina-Vulnerability-Exploitation-Detection-and-Mitigation

Folina-脆弱性-悪用-検出-緩和...

CVE-2020-16012-PoC

M2 プロジェクト - Side Channel Attack クライアント Chrome バージョン 83 インストールリンク https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Linuxx64/756066/ 起動コマンド root@kitploit: unzip Linux...chrome.zip cd chrome-linux/ ./chrome --disable-gpu --disable-software-rasterizer --no-sandbox...

apache-struts-cve-2017-5638-project

apache-struts-cve-2017-5638-project 攻撃と防御のコースプロジェクト。CVE-2017-5638の分析、悪用、および緩和策に焦点を当てています。...

Teach-AppSec

Teach-AppSec Teach AppSec は、現在リスク管理、ソフトウェア開発、および運用セキュリティの教育モジュールを備えた OWASP Application Security プロジェクトです。 このプロジェクトには、モジュールが開発され次第、さらに追加される予定です。 このプロジェクトは GNU General Public License v2.0 の下で提供されており、以下の許可と条件が適用されます: Permissions| Limitations| Conditions ---|---|--- 商用利用| 免責| ライセンスおよび著作権表示 変更| 保証|...

CVE-2024-54879

一、プロジェクト概要 二、脆弱性の説明 1、ロジックバグ - 無制限チャージメンバー カテゴリ| 内容| 備考 ---|---|--- 脆弱性の場所（URL）| センターを訪問し、スーパーメンバーをクリックします 月額100ゴールドをクリックしてパックを獲得します gidパラメータを1に変更すると、システムはチャージ成功を返します 個人センターのページを更新すると、1ヶ月分の会員期間が正常に追加されます 複数のパックを購入し、個人センターのページをもう一度更新すると、期間が延長されているのを確認できます...

Ncast busiFacade - Remote Command Execution

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier. id: CVE-2024-0305 info: name: Ncast busiFacade - Remote Command Execution author: BMCel...

Monitorr 1.7.6m - Unauthenticated Remote Code Execution

Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote cod...

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

Documentor <= 1.5.3 - Unauthenticated SQL Injection

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users. id: CVE-2022-0773 info: name: Documentor = 1.5.3 - Unauthenticated SQL...

WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload

WordPress SP Project & Document Manager plugin before 4.22 is susceptible to authenticated shell upload. The plugin allows users to upload files; however, the plugin attempts to prevent PHP and other similar executable files from being uploaded via checking the file extension. PHP files can still...

XStream <1.4.6/1.4.10 - Remote Code Execution

Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to...