147416 matches found
CVE-2025-61455
🛡️ CVE 披露：CVE-2025-61455 — 电子商务项目中的 SQL 注入漏洞 披露日期： 2025 年 10 月 14 日 CVE ID： CVE-2025-61455 严重性： 严重（CVSS 9.8） 🧩 摘要 E-commerce Project v1.0 中存在一个严重的 SQL 注入漏洞，具体位于 signup.inc.php 端点。该应用程序直接将未经净化的用户输入拼接到 SQL 查询中，允许未经身份验证的攻击者绕过身份验证并执行任意 SQL 命令。 此问题已被分配标识符 CVE-2025-61455 。在公开披露时，尚无官方补丁 可用。 📦 受影响产品 供应商：...
CVE-2022-46169_poc
CVE-2022-46169 未经身份验证的远程代码执行 描述 认证绕过：对于大多数 Cacti 安装，基于主机名的授权检查未安全实现 命令注入：未净化的用户输入被传播到用于执行外部命令的字符串 演示 POC 安装 使用 go install root@kitploit: go install github.com/devAL3X/CVE-2022-46169poc 运行二进制文件： root@kitploit: CVE-2022-46169poc 手动构建 或者，你也可以手动构建二进制文件： 首先，确保你的机器上已安装 Go，并且设置了 $GOPATH 环境变量。 克隆仓库：...
cve-2026-34473-unauthenticated-dos-zte-routers
CVE-2026-34473: Denegación de servicio no autenticada en routers ZTE que afecta a más de 140 000 dispositivos en todo el mundo más de 17 modelos Desglose técnico de CVE-2026-34473, publicado a partir del conjunto de divulgación original y de los artefactos de análisis de firmware. Sitio en vivo:...
CVE-2026-38360
CVE-2026-38360：dash-uploader 中的路径遍历 未经身份验证的路径遍历影响 fohrloop/dash-uploader（Python，PyPI），可导致任意文件写入，进而（但不限于）实现 远程代码执行（RCE） 、应用程序源代码覆盖、存储型 XSS 以及持久后门安装。 ⚠️ 无补丁可用，且永远不会发布 该仓库已于 2025 年 7 月 19 日归档，没有活跃维护者。所有已发布版本（0.1.0 至 0.7.0a2）均受影响且将一直如此。该包每月仍有大约 28,000 次下载。 任何在生产环境中运行 dash-uploader...
CVE-2026-84376
Astro is a web framework for content-driven websites. Prior to 7.2.4 , it stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. For example, with base "/app", a request to "/appX/admin" resolved internally to the pro...
CVE-2026-3891-Linux
root@kitploit: ███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝...
CVE-2026-78689
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
EUVD-2026-70211
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...
CVE-2026-20355 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...
CVE-2026-20354
CVE-2026-20354 affects the S/MIME decryption functionality of Cisco Secure Email . The root cause is insufficient validation of message integrity , allowing an unauthenticated remote attacker to use a man-in-the-middle technique to intercept and modify traffic between email gateways. A successful...
EUVD-2026-70209
A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol SIP Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This...
CVE-2026-20281
Cisco Desk Phone 9800 Series, IP Phone 7800/8800 Series, and Video Phone 8875 running Cisco SIP Software are affected by a denial-of-service vulnerability caused by improper memory management when processing HTTP packets. An unauthenticated, remote attacker can send a continuous stream of crafted...
CVE-2021-22986
CVE-2021-22986 此漏洞允许未经过身份验证的攻击者通过网络访问iControl REST接口（通过BIG-IP管理接口和自IP地址），执行任意系统命令、创建或删除文件以及禁用服务。此漏洞仅能通过控制平面利用，无法通过数据平面利用。利用该漏洞可能导致系统完全沦陷。Appliance模式下的BIG-IP系统同样受影响。 受影响产品 F5 BIG-IQ 6.0.0-6.1.0 F5 BIG-IQ 7.0.0-7.0.0.1 F5 BIG-IQ 7.1.0-7.1.0.2 F5 BIG-IP 12.1.0-12.1.5.2 F5 BIG-IP 13.1.0-13.1.3.5 F5...
CVE-2026-20212
CVE-2026-20212 affects the Silicon One Hardware Abstraction Layer (S1HAL) in Cisco Nexus 9000 Series Switches . The root cause is that TCP ports 43210 and 43211 are accessible in the default Layer 3 VRF, allowing an unauthenticated, remote attacker to send crafted input that executes code with ro...
EUVD-2026-70201
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...
CVE-2026-20212 Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...
CVE-2021-29441
CVE-2021-29441 运行: CVE-2021-29441.exe ip 阿里nacos 越权添加账户...
CVE-2021-30461
受影响的产品 VoIPmonitor 24.60 如何实现 RCE root@kitploit: python3 CVE-2021-30461.py -t ipaddress 浏览器 Shell： root@kitploit: http://x.x.x.x/namrlblgel.php?a=whoami 参考 https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/...
CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary
👤 Autor Mohammed Idrees Banyamer Investigador de Seguridad 📌 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2026-25939 , una vulnerabilidad crítica de omisión de autorización en FUXA software SCADA/ICS de código abierto. La vulnerabilidad permite a atacantes remot...