145348 matches found
Jenkins-CVE-2024-23897-Lab
مختبر Jenkins CVE-2024-23897 ثغرة قراءة ملفات تعسفية في Jenkins 2.441 والإصدارات الأقدم. بدء التشغيل docker-compose up -d الهجوم التلقائي docker exec -it attacker-host ./auto-exploit.sh الهجوم اليدوي docker exec -it attacker-host bash cd /tmp curl -o jenkins-cli.jar...
CVE-2020-14882
CVE-2020-14882 Ce script permet l'exécution de code à distance RCE sur Oracle WebLogic Server à l'aide d'une requête GET non authentifiée. Il exploite la vulnérabilité CVE-2020-14882. En exécutant des commandes arbitraires, un attaquant peut obtenir un accès non autorisé au serveur. Détails de...
CVE-2026-62142
Cross-Site Request Forgery CSRF vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0...
CVE-2026-44031
Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...
CVE-2026-106611
Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-102784
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
CVE-2022-2466---Request-Context-not-terminated-with-GraphQL
CVE-2022-2466 - عدم إنهاء سياق الطلب مع GraphQL كيفية التشغيل 1. قم بتشغيل mvn:quarkus:dev 2. قم بتنفيذ طلبات HTTP التالية قم بتشغيل هذا مرتين POST http://localhost:8080/graphql Content-Type: application/graphql Authorization: Bearer...
CVE-2025-45250
CVE-2025-45250 Description suggérée MrDoc =0.95 est vulnérable à une falsification de requête côté serveur SSRF dans la fonction validateurl du fichier appdoc/utils.py. POC POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0...
CVE-2021-40438
CVE-2021-40438 Запрос uri-path может привести к тому, что modproxy перенаправит запрос на исходный сервер, выбранный удаленным пользователем. Эта проблема затрагивает Apache HTTP Server 2.4.48 и более ранние версии. Злоумышленник может использовать эту уязвимость, создав запрос с URI-путем, котор...
EUVD-2026-94955
Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-106611
The WPMU DEV Forminator plugin (versions n/a through 1.57.3 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is associated with CWE-352 and has a High base sever...
cve-2026-40072-ssrf-lab
Labo SSRF CVE-2026-40072 Laboratoire pratique local pour démontrer CVE-2026-40072 dans web3.py, montrer l'impact SSRF dans Burp Suite et vérifier le correctif officiel. Aperçu Ce dépôt contient une preuve de concept sécurisée, locale uniquement, pour CVE-2026-40072, un problème de Server-Side...
Remove-IIS-RIIS
Remove-IIS-RIIS- CVE-2015-1635...
CVE-2026-37432
CVE-2026-37432 Emplacement : Apiutil.java : 107-113 Principe : Faire directement confiance à l'en-tête de requête X-Forwarded-For, qui peut être falsifié pour manipuler les adresses IP. Méthode d'exploitation : X-Forwarded-For : 127.0.0.1...
poc_proxylogon
pocproxylogon مايكروسوفت إكستشينج ProxyLogon إثبات المفهوم CVE-2021-26855 هذا النص البرمجي صُنع أصلاً بواسطة celesian لاستغلال هذه الثغرة الأمنية. ثم قمت بتحديثه لاستغلال خادم إكستشينج معرض لهجوم SSRF لكنه حصل على شيل باستغلال ميزة EWS، لأن شركة عميل قامت بتصحيح خادم الإكستشينج الخاص بها عن طريق...
CVE-2026-44031
Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...
EUVD-2026-94935
Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...
CVE-2026-102784
The Joomla Extension - balbooa.com - Gridbox (versions
CVE-2026-62142
The Melapress WP 2FA plugin (wp-2fa) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions 4.1.0 and below . This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The documentation does not specify the exact component...