1240 matches found
WordPress-XStore-theme-SQL-Injection
WordPress-XStore主题-SQL注入 CVE-2024-33559 XStore主题SQL注入 CVE-2024-33551 是 8theme XStore（一个基于 WordPress 构建的电子商务平台）中的一个 SQL 注入漏洞。该漏洞允许攻击者在数据库上执行恶意 SQL 命令，从而导致数据被窃取、删除甚至篡改。 Poc root@kitploit: POST /?s=%27%3B+SELECT++FROM+wpposts%3B+-- HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Windows NT 10.0;...
CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability
CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability 익스플로잇 작성자: ersinerenler 공급업체 홈페이지 https://code-projects.org/blood-bank-in-php-with-source-code 소프트웨어 링크 https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip 개요 Code-Projects Blood...
text4shell-cve-2022-42889
Text4Shell CVE-2022-42889 CVE-2022-42889용 Docker 실습 Docker 이미지를 로컬에서 직접 빌드하거나 Docker Hub에서 이미지를 가져와 컨테이너를 실행할 수 있습니다. 저장소 클론하기 root@kitploit: git clone https://github.com/devenes/text4shell-cve-2022-42889.git Docker 이미지를 로컬에서 빌드하기 root@kitploit: docker build --tag=text4shell . Docker 컨테이너 실행하기...
cve-2022-42889-text4shell-docker
Установка maven - maven-linux 1. Установка Maven для создания fat jar root@kitploit: mvn clean install 2. Сборка Docker root@kitploit: docker build --tag=text4shell . 3. Запуск Docker root@kitploit: docker run -p 80:8080 text4shell 4. Тестирование приложения root@kitploit:...
Lyrion Music Server <= 9.2.0 - Cross-Site Scripting
Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...
CVE-2022-38553
CVE-2022-38553 크로스 사이트 스크립팅 XSS - "ACADEMY LEARNING MANAGEMENT SYSTEM" v5.9.1 미만 - 개념 증명 POC CVE-2022-38553 익스플로잇 제목: ACADEMY LEARNING MANAGEMENT SYSTEM POC 동영상:...
CVE-2026-9848
CVE-2026-9848 CVE-2026-9848 は、WordPress 用プラグイン WP Ticket Customer Support Ticket System & Helpdesk のバージョン 6.0.4 以前に影響する未認証SQLインジェクション（SQLi）脆弱性です。この欠陥は、プラグインがWordPressの検索パラメータ s を取得し、それを $wpdb-prepare や適切なエスケープ処理を使わずにUNIONサブクエリ内のSQL...
CVE-2020-35545
CVE-2020-35545 Spotweb 1.4.9 - 'search' SQL Injection...
CVE-2024-50969
CVE-2024-50969 Описание Отражённая межсайтовая скриптинговая XSS уязвимость в browse.php приложения Code-projects Jonnys Liquor 1.0 позволяет удалённым злоумышленникам внедрять произвольные веб-скрипты или HTML через параметр search. Тип уязвимости Межсайтовый скриптинг XSS Производитель...
CVE-2016-10993
CVE-2016-10993 WordPressの脆弱性 - XSS（クロスサイトスクリプティング） 脆弱性の場所 https://themesinfo.com/scoreme-wordpress-theme-design-496 概念実証 PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E 参考文献 https://wpscan.com/vulnerability/8431...
EUVD-2026-64668
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
CVE-2026-78143
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
CVE-2026-78143
A SQL injection vulnerability exists in the Barangay Resident Profiling Management System 1.0 (code-projects), specifically in the Resident Search Functionality within the file residents.php. The unsanitized Search argument allows a remote, unauthenticated attacker to inject SQL commands. The exp...
CVE-2026-78143 code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
PT-2026-79785
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
EUVD-2026-63820
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
THM-Steel_Mountain-CVE-2014-6287
THM-SteelMountain-CVE-2014-6287 TryHackMe.com의 Steel Mountain 박스에 대한 분석 글 및 CVE-2014-6287 익스플로잇 크레딧 저는 이 취약점의 최초 발견 및 익스플로잇에 대한 공로를 주장하지 않습니다. 다음 분들께 감사드립니다! 발견: Daniele Linguaglossa Metasploit 모듈 작성자: Muhamad Fadzil Ramli TryHackMe 룸 및 작성자: https://tryhackme.com/room/steelmountain...
Winter: Reflected XSS through the search query parameter in the backend Table widget
Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...