CVE-2024-2997

CVE-2024-2997 扫描器 概述 CVE-2024-2997 扫描器是一款高级漏洞扫描器，用于检测 Web 应用中的命令注入漏洞。该工具可帮助安全专业人员识别其应用中潜在的安全风险。 免责声明 本工具仅供教育目的 使用。请仅在您拥有或已获得测试许可的应用上使用。作者不对因使用本工具造成的任何滥用或损害负责。 功能特性 高性能扫描 ：利用多线程（最多 20 个线程）实现快速扫描 全面的 URL 生成 ：生成大量潜在易受攻击的 URL 实时进度跟踪 ：通过动态进度条显示扫描进度 详细报告 ：生成扫描结果的文本和 HTML 报告 漏洞分类 ：按置信度对发现进行分类（低、中、高、严重）...

Navidrome < 0.53.0 - Authenticated SQL Injection

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not...

GetBlocked

GetBlocked! 更干净的页面。更少的追踪器。仅本地运行。 GetBlocked! 是一款轻量级、仅本地运行的 Chrome 扩展程序，它通过拦截已知的追踪器请求、清理追踪链接并解释追踪尝试来帮助减少常见的第三方网站追踪。 它被构建为一个可检查的 Manifest V3 项目，适合想使用友好隐私工具的用户，也适合希望快速提交有价值拉取请求的贡献者。 GetBlocked! 的功能 使用 Chrome 的 declarativeNetRequest 拦截一组精心挑选的已知第三方追踪器域名。 清理常见的追踪 URL 参数，例如...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange 存在服务端请求伪造漏洞 Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

CVE-2020-12124

CVE-2020-12124 Una implementación de una prueba de concepto para CVE-2020-12124 https://vulners.com/cve/CVE-2020-12124 root@kitploit: The following is an actualization of CVE-2020-12124, a vulnerability which exploits a command injection in the Wavlink WN530H4 router in which certain parameters a...

CVE-2024-4577

Orange Tsi 🍊 该漏洞由 Orange Tsai（@orange8361）来自 DEVCORE（@d3vc0r3）发现。请务必关注他卓越的研究，我们的角色仅是复现并为该问题开发利用程序。 安全警报：CVE-2024-4577 PHP CGI 参数注入漏洞 概述 CVE-2024-4577 是一个影响 PHP CGI 配置的严重漏洞，允许攻击者通过精心构造的 URL 参数执行任意命令。 受影响版本 PHP 8.3 8.3.8 PHP 8.2 8.2.20 PHP 8.1 8.1.29 攻击向量 攻击者可通过向 PHP CGI...

kadimus

kadimus LFI 扫描与利用工具 kadimus 是一个用于检测和利用 LFI 漏洞的工具，专注于 PHP 系统。 功能： 检查所有 URL 参数 /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE expect://cmd RCE 源码泄露 通过 HTTP 请求的命令行界面 代理支持 socks4://, socks4a://, socks5://, socks5h:// 和 http:// 对远程连接的 socks5 代理支持 编译：...

swagger-ui

引言：Swagger UI 的作用 Swagger UI 是一个广泛使用的库，它能将 OpenAPI（原 Swagger）规范渲染为交互式 Web 界面。开发者与集成人员无需后端实现即可探索和测试 API。 CVE‑2018‑25031 详情 根本原因：远程规范加载 该漏洞源于 Swagger UI 客户端对用于加载远程配置或规范文件的 URL 查询参数验证不足。涉及的常见参数包括： ?url=.yaml ?configUrl=.json 攻击者可将这些参数指向一个攻击者控制的、远程托管的 OpenAPI 定义或配置文件，该文件可能被易受攻击的实例渲染。 潜在攻击向量...

CVE-2023-24488

CVE-2023-24488 针对 CVE-2023-24488 的 POC Citrix Gateway 开放重定向与 XSS CVE-2023-24488 URL 查询参数在放入 HTTP Location 头之前未进行充分清理。攻击者可以利用这一点创建链接，当受害者点击该链接时，会被重定向到任意位置。或者，攻击者可以在 Location 头中注入换行符，以提前结束 HTTP 头，并在响应主体中注入 XSS 载荷。 安装要求 root@kitploit: pip3 install -r requirements.txt 用法： root@kitploit: usage: python...

CVE-2026-52775

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

PT-2026-83748

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...

CVE-2026-44227

RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...

CVE-2024-23567

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local...

CVE-2026-44454 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a craft...

CVE-2026-56224 Capgo - Login CSRF and Session Fixation via URL Query Parameters

Capgo console.capgo.app/login before 12.128.2 accepts accesstoken and refreshtoken in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs...

CVE-2026-57498

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId$teamId before any operation. However, multiple Livewire web UI components accept...