waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Save it with filename: payload.txt and upload it on a server. The URI should look like: https://yoursite.com/payload.txt. Finally, supply your --target and --payload-uri options: $ python cve-2019-9978.py...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

WordPress Button Generator <2.3.3 - Remote File Inclusion

WordPress Button Generator before 2.3.3 within the wow-company admin menu page allows arbitrary file inclusion with PHP extensions as well as with data:// or http:// protocols, thus leading to cross-site request forgery and remote code execution. id: CVE-2021-25052 info: name: WordPress Button...

NagiosXI-RCE-all-version-CVE-2021-40345

NagiosXI RCE File-Upload CVE-2021-40345 Authentified RFI to RCE Nagios/NagiosXI exploitation Step 1 : Go on the "dashlets" managing page and download one of them I'm using "rssdashlet" for the exemple : http://TARGETIP/nagiosxi/admin/dashlets.php?download=rssdashlet Step 2 : Modify the .inc.php I...

automatic-api-attack-tool

Herramienta Automática de Ataque a APIs La herramienta de ataque a API personalizable de Imperva toma una especificación de API como entrada, y genera y ejecuta ataques basados en ella como salida. La herramienta es capaz de analizar una especificación de API y crear escenarios de ataque de fuzzi...

Exploit-Machine

Analisis Kerentanan — Canto HackMyVM Breakdown alur exploit...

Netmask NPM Package - Server-Side Request Forgery Detection

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the...

WordPress Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE Detection

WordPress Simple Fields 0.2 is vulnerable to local file inclusion, remote file inclusion, and remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Simple Fields 0.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Wordpress Brandfolder - Remote/Local File Inclusion Detection

WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote server and disclose their content. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote...

WordPress Canto Plugin <= 3.0.4 - File Inclusion Detection

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wpabspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allowurlinclude is enabled, exploit requires allowurlinclude to be enabled. !/usr/bin/env python3 --...

rapidscan

This is a Python-based web vulnerability scanner called RapidScan. It is designed to automate the process of security scanning by using a multitude of available Linux security tools and some custom scripts. The tool is still under development and currently supports around 80 vulnerability tests...

CVE-2021-24472

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF Server...

CVE-2024-52501: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through = 1.3.0...

iwlwifi DoS

The vulnerability of the iwlwifi component in the Linux operating system is related to the lack of memory release after the effective service life in the function iwlrfigetfreqtable. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks The Linux kernel CVE team has assigned CVE-2024-35912 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35912-b093@gregkh/T...

kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks The Linux kernel CVE team has assigned CVE-2024-35912 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35912-b093@gregkh/T...

CVE-2024-4498 Path Traversal and RFI Vulnerability in parisneo/lollms-webui

A Path Traversal and Remote File Inclusion RFI vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the /applysettings function, allowing an attacker to manipulate the discussiondbname...

CVE-2024-4498 Path Traversal and RFI Vulnerability in parisneo/lollms-webui

A Path Traversal and Remote File Inclusion RFI vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the /applysettings function, allowing an attacker to manipulate the discussiondbname...

CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...