291215 matches found
Project-CVE-2015-1635
CVE-2015-1635 CVE-2015-1635, MS15-034 Vulnerability Detection USAGE python MS15-034.py www.xxx.com:80 Test Program HTTP.sys Remote Code Execution Vulnerability CVE-2015-1635, MS15-034 A remote code execution vulnerability exists in the HTTP protocol stack HTTP.sys when HTTP.sys does not properly...
CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
CVE-2026-93484
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated
CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...
CVE-2022-35841
CVE-2022-35841 This is only a small writeup with the theory, as this bug was collided on and I never did get around to properly testing this. EnterpriseAppMgmtSvc is an interesting service implementing COM objects. Seems to date from Windows Phone and indeed, most of the COM interfaces implemente...
CVE-2014-7911-CVE-2014-4322_get_root_privilege
CVE-2014-7911poc Local root exploit for Nexus5 Android 4.4.4KTU8P author: andy website: https://blog.csdn.net/koozxcv how to build Import the project into eclipse,and build. bug info http://seclists.org/fulldisclosure/2014/Nov/51 analysis...
CVE-2025-7461
CVE-2025-7461: SQL Injection Vulnerability Analysis in Modern Bag E-commerce System 🌐 Language / 语言 : English | 简体中文 Vulnerability Overview Vulnerability Database: https://vuldb.com/?id.316112 Project Source: https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/ Item...
EUVD-2026-101821
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
CVE-2026-93484
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
CVE-2026-93484
The software Znuny (versions through 7.3.6 ) is vulnerable to SQL Injection (CWE-89) due to improper sanitization of user-supplied input. The vulnerability exists in the Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB components when processing the ContentS...
EUVD-2026-101820
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
cisco-ios-xe-implant-scanner
Cisco IOS XE Implant Scanner On October 23, 2023, with all implants no longer responding to requests to /webui/logoutconfirm.html, Fox-IT developed a new way to determine if a system is compromised or not. In particular, instead of responding to requests with a redirect to the login, the attacker...
CVE-2023-27350
! Be careful executing this as it re-configures the server config in order to execute commands. The script reverts the changes on exit but might not revert it if the process is improperly killed ! CVE-2023-27350 Papercut Unauthenticated RCE Versions The script automatically tests if server is...
Antecursor
Antecursor The Antecursor Project is an open-source and open-hardware project created by infosec students with the goal of developing an autonomous and modular system for network based information gathering and exploitation. Audience Antecursor is intended to help BOTH blue team and red team and...
zscan
zscan A fast, customizable service detection tool powered by a flexible fingerprint system. It helps you identify services, APIs, and network configurations across your infrastructure. Documentation | Features | Installation | Usage ✨Features Active Scanning Engine : High-performance concurrent...
CVE-2023-28343
CVE-2023-28343 Altenergy Power System Control Software settimezone RCE Vulnerability CVE-2023-28343 Chinese name: Altenergy Power System Control Software settimezone 远程命令执行漏洞（CVE-2023-28343） CVSS core:9.0 Description : Altenergy Power System Control Software is a microinverter control software fr...
cve-2024-4577
cve-2024-4577 poc Check for vulnerabilities python cve-2024-4577.py -u http://172.16.128.133 After a vulnerability is detected, you can use -c to execute a custom command python cve-2024-4577.py -u http://172.16.128.133 -c '?php system'whoami';'...
CVE-2022-40347_Intern-Record-System-phone-V1.0-SQL-Injection-Vulnerability-Unauthenticated
CVE-2022-40347: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Exploit Title: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...
QNAP Photo Station - Path Traversal
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. id: CVE-2019-7195 info: name: QNAP Photo Station - Path Traversal author: s4e-io severity: critical description: | QNAP devices running Pho...
Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...