CVE-2025-15679

CVE-2025-15679 affects the BMC (Baseboard Management Controller) root account , which can become active without a password under certain circumstances such as a reset to factory default operation. This grants unauthenticated local access with HIGH impact on confidentiality, integrity, and availab...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - 未认证的任意SQL执行导致远程代码执行 CVE-2024-43918 WordPress的WBW Product Table Pro插件在版本1.9.4及之前的所有版本中，由于对一个函数缺失功能权限检查，容易受到未授权的任意SQL执行攻击。这使得未认证的攻击者能够执行任意SQL查询，从而窃取敏感数据或获得对易受影响站点的提升访问权限。 如需更多WordPress漏洞利用及独家漏洞，请通过Telegram联系我 @KtN1990。 使用 运行此漏洞利用程序需要安装python 3，并准备一个网站列表，然后执...

CVE-2023-45878

CVE-2023-45878 GibbonEdu 任意文件写入到 Web Shell 执行 描述 本仓库包含针对 CVE-2023-45878 的利用代码，这是 GibbonEdu 中的一个任意文件写入漏洞。该漏洞影响 rubricsvisualisesaveAjax.php 端点，允许未经身份验证的攻击者向 Web 服务器上传任意文件。 此脚本利用该漏洞上传 PHP Web Shell ，并可以选择： 执行 特定系统命令 ； 触发 Base64 编码的 PowerShell 反向 Shell 以获取远程访问权限。 用法 脚本支持两种操作模式： --command...

CVE-2025-11262-Lab

CVE-2025-11262 - XSS Ciega Almacenada No Autenticada en Link Whisper Free Resumen Ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir CVE-2025-11262 , una vulnerabilidad de cross-site scripting almacenada no autenticada que afecta al plugin de WordPress Link Whisper...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Authentication Bypass This repository contains an English, redacted write-up and a Go-based verification tool for CVE-2026-41940, a cPanel/WHM authentication bypass caused by CRLF injection in Basic Authentication handling. All live target lists, asset exports, scan...

CVE-2026-37067

CVE-2026-37067 Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2020-24030

CVE-2020-24030 描述 ForLogic Qualiex v1 和 v3 存在令牌过期机制薄弱的问题。这允许远程未认证攻击者通过令牌重用进行权限提升并访问敏感数据。 重要日期 公告（致供应商）：2020-07-12 公开披露日期：2020-08-31 漏洞类型 访问控制不当 产品供应商 ForLogic 受影响产品代码库 Qualiex - v1 Qualiex - v3 其他版本也可能受影响，尤其是同一系列（尚未测试） 受影响组件 Qualiex 攻击类型 远程 权限提升影响 是 信息泄露影响 是 攻击向量 授权令牌过期机制薄弱，允许重用令牌以获取权限并访问敏感数据...

CVE-2026-66729-Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash

安全披露：facil.io MIME 解析器中的越界读取导致服务器崩溃 指定 CVE ID CVE-2026-66729 产品： facil.io 受影响版本： facil.io = 0.6.0（所有 0.6.x、所有 0.7.x、master）；该问题随 0.6.0 中新增的 MIME 解析器引入 组件： lib/facil/http/parsers/httpmimeparser.h CWE： CWE-191（整数下溢）、CWE-125（越界读取） CVSS v3.1： 7.5（AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H） 研究人员： Theodosis...

CVE-2019-6447-ES-File-Explorer

CVE-2019-6447: ES File Explorer Unauthenticated HTTP Service An independently implemented, safety-conscious research harness and technical analysis for CVE-2019-6447 , an unauthenticated HTTP service exposed by vulnerable versions of ES File Explorer for Android. Authorized research only. Use thi...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

Cross-Site Scripting XSS almacenado sin autenticación en genai/evalsvisualization.py del SDK de Google Cloud Vertex AI google-cloud-aiplatform versiones desde 1.98.0 hasta sin incluir 1.131.0 - github.com/googleapis/python-aiplatform Autor: Joshua Provoste Investigador y desarrollador de N-day...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - 未认证的权限提升（通过密码更新/账户接管） 📌 主题信息 插件 ：Motors = 5.6.67 - 未认证的权限提升（通过密码更新/账户接管） 受影响版本 ：= 5.6.67 CVE ：CVE-2025-4322 严重性 ：9.8（严重） CWE ID ：CWE-620 CWE名称 ：未经验证的密码更改 已修复 ：✅ 是 补丁优先级 ：🔴 严重 发布日期 ：2025年5月19日 研究员...

EUVD-2026-76006

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

CVE-2026-89179

WeenyGenius , a computer lab management system by Howyar Technologies , is affected by a Missing Support for Integrity Check vulnerability. An unauthenticated attacker on the same (adjacent) network can intercept a student's connection packet and replay it, forging the appearance that the student...

CVE-2026-89179 Howyar｜WeenyGenius - Missing Support for Integrity Check

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

CVE-2019-3980-Open_Net_Admin_v18.1.1_RCE

CVE-2019-3980 – OpenNetAdmin 18.1.1 远程代码执行 ⚠️ 免责声明 本仓库严格仅供教育和研究目的使用 。 此处提供的信息和代码仅可用于受控环境 ，例如私有实验室机器。 未经授权将本代码用于非您所有或未经明确许可测试的系统，属于非法且不道德的行为。 作者不对任何滥用或造成的损害负责 。 🔍 关于漏洞 OpenNetAdmin 18.1.1 通过 xajax AJAX 请求接口存在远程代码执行漏洞。 该漏洞源于不正确的输入清理，允许通过向 /ona/ 发送特制的 POST 请求进行命令注入。 此漏洞利用 tooltips 插件触发反向 shell...

CVE-2026-89178

WeenyGenius , a computer lab management system by Howyar Technologies , suffers from an Origin Validation Error that allows unauthenticated attackers on the same network to spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection wit...

EUVD-2026-76005

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89178 Howyar｜WeenyGenius - Origin Validation Error

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89177

WeenyGenius is a computer lab management system by Howyar Technologies . The vulnerability stems from reliance on ZMTP Null mode , an unauthenticated zero-message-transport-protocol handshake that provides no encryption or integrity. An unauthenticated attacker on the same (adjacent) network can ...

CVE-2026-89177 Howyar｜WeenyGenius - Use of Insecure Protocol

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...