buyer-eval-skill

Buyer Eval 一款用于采购 B2B 软件的 AI 分析师。 把你正在考虑的供应商交给它。Buyer Eval 会调查他们宣称的内容， 核查证据，找出其中的缺口和矛盾，并为你提供在购买前 需要提出的问题。你会得到一份可以转发给所有 参与采购的其他人的决策简报。 You: Evaluate Vendor A and Vendor B for customer success. We need deep Salesforce sync and we can't wait 6 months to go live. 几分钟后： 我们的发现： 调查了 8 项声明。3 项已核实，2 项有条件成...

EUVD-2026-92444

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

Moodle-CVE-2024-43425-Exploit

Moodle RCE 漏洞利用 CVE-2024-43425 本仓库包含一个针对 Moodle CVE-2024-43425 远程代码执行 RCE 漏洞的 Python 利用脚本。 免责声明： 本工具按 原样 提供，仅用于教育和研究目的。仅可在获得明确测试许可的系统上使用。作者不对因滥用此脚本造成的任何损害或法律问题负责。 无法提取问题 ID 错误： 访问题目创建页面并检查值。如果 categories HTML 标签中不存在 4,3，请在代码中修改。 依赖要求 Python 3.6+ Requests 库 使用 pip 安装所需包： pip install requests...

CVE-2024-43425-Poc

CVE-2024-43425-Poc CVE 概述 CVE ID: CVE-2024-43425 描述: Moodle 允许经过身份验证的教师级用户通过测验编辑器界面上传恶意的计算题。 影响: 远程代码执行 RCE 原因: 对计算题内的数学负载清理不当，导致通过数据集向导实现命令注入。 要求: 有效的登录凭据 访问测验编辑界面的权限（通常是教师或管理员角色） 已知的 cmid（测验模块 ID）和 courseid 此脚本执行 5 步攻击: 步骤| 描述 ---|--- 1️⃣| 获取登录令牌 logintoken 2️⃣| 登录并建立有效的 MoodleSession 3️⃣|...

Moodle-authenticated-RCE

Moodle 4.4.0 - 已验证远程代码执行 CVE-2024-43425 漏洞利用 CVE: CVE-2024-43425 受影响版本 Moodle 4.4 至 4.4.1 Moodle 4.3 至 4.3.5 Moodle 4.2 至 4.2.8 Moodle 4.1 至 4.1.11 描述 该漏洞利用针对上述 Moodle 版本中已验证的远程代码执行（RCE）漏洞。它允许拥有有效凭据的攻击者通过利用不安全的题库编辑功能在服务器上执行任意命令。 使用方法 1. 克隆或下载此仓库。 2. 安装所需的依赖项： pip install -r requirements.txt 3...

WP Cerber < 8.9.3 - Broken Access Control

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints. The exploit requires sending a request with a trailing '?'. id: CVE-2021-37598 info: name: WP Cerber 8.9.3 - Broken...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei模板： CVE-2022-1598.yaml 视频POC： https://www.youtube.com/watch?v=MbhiQKWvivQ 参考来源： https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...

CVE-2022-35650

CVE-2022-35650 这是一个在 Moodle 中的任意文件读取漏洞。 前提条件 你必须已攻破教师或管理员级别的用户账户。 步骤 1. 克隆此仓库： git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. 运行此命令来打包漏洞利用文件： zip exploit.zip imsmanifest.xml pool.dat 3. 浏览到一个你的账户拥有写入权限的课程。 4. 导航到 '题库'。 5. 从下拉菜单中选择 '导入'。 6. 选择 'blackboard' 作为格式。 7. 上传步骤 2 中的...

CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

2024InformationSecurityEngineer

2024InformationSecurityEngineer 2024年信息安全工程师、2024InformationSecurityEngineer 2024年下半年-信息安全工程师 例题回忆 软考-考试时间 : 2024年11月08日 一、防火墙抓包（14分） 1. 分组长度（2分） 答：63 2. 是真机还是虚拟机（2分） 答：虚拟机 3. 控制主机的ip及端口（2分） 答：192.168.1.218 14444 4. Wireshark对ip、端口的过滤规则（2分） 答：ip.addr == 192.168.2.105 and tcp.dstport == 14444 5...

Linux Distros Unpatched Vulnerability : CVE-2026-102578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

UBUNTU-CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578

A SQL injection vulnerability exists in the Moodle learning management system. An authenticated attacker who has access to the question bank web service can submit unsanitized input that is directly processed into database queries. This flaw allows the attacker to view, alter, or delete sensitive...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

EUVD-2026-89717

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...