Plixer Scrutinizer adminEditLang SQLi pg_cron RCE

Authenticated adminEditLang orderBy SQL injection schedules cron.scheduleindatabase COPY TO PROGRAM PostgreSQL/pgcron. """Plixer Scrutinizer adminEditLang ORDER BY SQLi to pgcron RCE.""" from future import annotations import re import time from urllib.parse import urlencode from kittysploit impor...

Plixer Scrutinizer adminEditLang ORDER BY SQL Injection Authenticated RCE — Detect

Fingerprint / reachability check for Plixer Scrutinizer adminEditLang ORDER BY SQL Injection Authenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Plixer Scrutinizer adminEditLang ORDER BY SQL Injection Authenticated RCE""" from kittysploit import from...

Scrutinizer Config - Detect

Scrutinizer configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Scrutinizer configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Scrutinizer Config ...

EUVD-2012-2613

Malware in sbrugna...

EUVD-2012-1286

Malware in sbrugna...

EUVD-2014-4891

Malware in sbrugna...

EUVD-2012-1287

Malware in sbrugna...

EUVD-2012-3795

Malware in sbrugna...

EUVD-2021-15640

Malware in sbrugna...

EUVD-2023-45779

Malicious code in bioql PyPI...

EUVD-2023-45780

Malicious code in bioql PyPI...

EUVD-2023-45778

Malicious code in bioql PyPI...

CVE-2023-41263

An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information...

CVE-2023-41262

An issue was discovered in /fcgi/scrutfcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application...

CVE-2023-41261

An issue was discovered in /fcgi/scrutfcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authentication and allows an unauthenticated user to export a report and access the results...

CVE-2021-28993

Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information remote...

CVE-2012-3848

Multiple cross-site scripting XSS vulnerabilities in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to d4d/exporters.php, 2 the HTTP Referer header to d4d/exporters.php, or 3...

CVE-2012-3951

The MySQL component in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer 9.0.1.19899 and earlier has a default password of admin for the 1 scrutinizer and 2 scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session...

CVE-2012-2627

d4d/uploader.php in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request...

CVE-2012-2626

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action...