wildPwn

wildPwn - WildFly 利用工具 这是一个用于 WildFly 的工具。该工具可用于暴力破解或 Shell 部署。 wildPwn.war 包含修改后的 Laudanum Shell。 userList.txt 包含常见用户名， passList.txt 包含常见密码。 用法 暴力破解 python wildPwn.py -m brute --target -user -pass Shell 部署 python wildPwn.py -m deploy --target --port -u -p 详情...

CVE-2026-57517

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

PT-2026-39512

Name of the Vulnerable Software and Affected Versions e107 CMS version 2.3.0 Description Authenticated users with theme installation permissions can execute arbitrary commands by uploading malicious theme files. An attacker can upload a crafted theme package through the 'theme.php' endpoint to...

Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass authentication and achieve remote code...

e-Excellence U-Office Force 代码问题漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. A code issue vulnerability exists in e-Excellence U-Office Force, which originates from an arbitrary file upload and could allow a remote attacker to upload and execute a Web Shell backdoor to...

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

Cybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data. "It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs...

Ivanti Addressed Second Zero-Day Flaw Exploited by Attackers

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-35081 in Ivanti EPMM enables admin-authenticated attackers to write arbitrary files, risking unauthorized access, OS command execution, and malicious web shell...