CVE-2026-92749

SafeLine through version 9.4.1 contains an authentication bypass in its management console. The session-signing secret is derived from a time-seeded math/rand generator , allowing unauthenticated remote attackers who can bound the install timestamp to reconstruct the key offline and forge valid a...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-2413-POC

CVE-2026-2413-POC Le plugin Ally – Web Accessibility & Usability pour WordPress est vulnérable à l'injection SQL via le chemin d'URL dans toutes les versions jusqu'à la 4.0.3 incluse. Cela est dû à un échappement insuffisant du paramètre d'URL fourni par l'utilisateur dans la méthode...

CVE-2026-92718

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2026-92718 Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2026-92718

Nuclei (ProjectDiscovery) versions from 3.7.0 before 3.11.1 contain a template signature bypass due to a cache that relies solely on file modification time rather than content checksums. An attacker with local access and low privileges can replace a signed template with unsigned malicious content...

CVE-2026-92718 Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2023-31702

CVE-2023-31702 — Injection SQL dans la console de gestion eScan Authentifié Présentation CVE-2023-31702 est une vulnérabilité d'injection SQL authentifiée découverte dans eScan Management Console version 14.0.1400.2281 de MicroWorld Technologies. La vulnérabilité se trouve dans le point d'accès...

CVE-2025-24799

CVE-2025-24799 Автоэксплойт ⚡ Обзор CVE-2025-24799 — это эксплойт proof-of-concept PoC, нацеленный на GLPI. Этот эксплойт демонстрирует неаутентифицированную SQL-инъекцию time-based blind для извлечения учётных данных пользователей. Отказ от ответственности: Этот PoC предназначен только для...

keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 Preuve de concept d'injection SQL non authentifiée -blue Des attaquants non authentifiés peuvent injecter du SQL arbitraire dans la clause ORDER BY via le paramètre sort du point de terminaison render-map de Geo Mashup, permettant l'extraction aveugle basée su...

CVE_2026_2576_PoC

CVE-2026-2576 — PoC d'injection SQLi du plugin Business Directory Injection SQL aveugle basée sur le temps, sans authentification Plugin Business Directory pour WordPress ≤ 6.4.21 Table des matières Présentation de la vulnérabilité Analyse technique Prérequis du laboratoire Configuration du...

CVE-2025-63585

CVE-2025-63585 Injection SQL aveugle basée sur le temps dans /action/rtcomments/status paramètre : timestamp Une vulnérabilité d'injection SQL aveugle basée sur le temps a été découverte dans le paramètre timestamp du point de terminaison /action/rtcomments/status. Un attaquant authentifié capabl...

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - SQL-инъекция через Subscriber+ Необходимо установленный sqlmap и действительные имя пользователя и пароль с ролью Subscriber+ Использование root@kitploit: usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show...

CVE-2022-45808

CVE-2022-45808 Plugin LearnPress 4.2.0 - Injection SQL aveugle basée sur le temps sans authentification Description Le plugin n'assainit pas correctement le paramètre order by et ne l'échappe pas avant de l'utiliser dans une requête SQL, conduisant à une injection SQL exploitable par des...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

CVE-2019-9053-Exploit-Python-3

CVE-2019-9053 익스플로잇 Python 3 이 저장소는 CMS Made SimpleCMSMS 소프트웨어에서 발견된 취약점 CVE-2019-9053에 대한 익스플로잇을 포함합니다. 이 익스플로잇은 Python 3에서 작동하도록 수정되었으며 CMSMS 버전 2.2.9 이하와 호환됩니다. 설명 CVE-2019-9053은 시간 기반 블라인드 SQLi 취약점으로, 공격자가 애플리케이션 응답의 지연을 모니터링하여 데이터베이스 정보를 열거할 수 있게 합니다. 이 취약점은 CMSMS 2.2.9 이하 버전에 존재합니다. 익스플로잇 세...

SimpleCTF-UpdatedExploit

CMS Made Simple = 2.2.10 Injection SQL - Exploit Vue d'ensemble Ce script Python exploite une vulnérabilité d'injection SQL non authentifiée dans CMS Made Simple = 2.2.10 CVE-2019-9053. L'exploit extrait des informations sensibles telles que le sel, le nom d'utilisateur, l'e-mail et le mot de pas...

Malicious code in cli-anything-ai-market (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5319f74a06670d40b020831dae38da696aa966dc1fdfde45063abb0024df922 setup.py runs automatically during pip install and POSTs the installer's OS, username USER/USERNAME, and hostname via COMPUTERNAME on Windows or the...

CMS-made-simple-sqli-python3

CMS-made-simple-sqli-python3 CMS Made Simple 2.2.10 - SQL-инъекция переписано для python3, CVE-2019-9053 Мне было затруднительно запускать этот эксплойт на kali linux, поскольку в python2 нет termcolor, поэтому, изменив лишь пару скобок, я заставил его работать на python3. Вся заслуга принадлежит...