CVE-2011-2523

Уязвимость бэкдора Vsftpd 2.3.4 Уязвимость Когда хакер вводит строку, добавляющую : в параметр USER, на порту 6200 открывается бэкдор...

CVE-2011-2523

vsftpd 2.3.4 Backdoor Exploit FTP-сервер: vsftpd Уязвимая версия: 2.3.4 CVE: CVE-2011-2523 Уязвимость: бэкдор на порту 6200 открывается, когда пользователь вводит строки с добавлением : в параметр USER ftp Примечания: для RCE не требуется аутентификация...

CVE-2025-0133-exploit

CVE-2025-0133 Scan Un script écrit en python pour vérifier l'existence d'une vulnérabilité de type Cross-Site Scripting réfléchi CVE-2025-0133 affectant Palo Alto. Le fichier getconfig.esp est détecté et testé pour une XSS à l'aide du script fourni. Utilisation :...

CVE-2023-6275

CVE-2023-6275 - Cross-Site Scripting Réfléchi dans la plateforme TOTVS Fluig 1.6.X - 1.8.1 La plateforme TOTVS Fluig, dans ses versions de 1.6.1.X à 1.8.1, est vulnérable au Cross-Site Scripting dans les paramètres 'redirectUrl' et 'user' du module 'mobileredir'. Fluig est la plateforme de...

CVE-2026-24061

CVE-2026-24061 Шаги воспроизведения Сборка образа docker build -t telnetd-bypass . Запуск контейнера docker run -it --rm \ --name telnetd-vuln \ --privileged \ -p 23:23 \ telnetd-bypass Отправка payload USER='-f root' telnet -a 127.0.0.1 23 Результат Trying 127.0.0.1... Connected to localhost...

CVE-2026-6182-SQLI-auth

Обход аутентификации через SQL-инъекцию — Простая система управления контентом на PHP Описание Уязвимость SQL-инъекции существует на странице входа в админ-панель простой системы управления контентом на PHP. Параметр user не подвергается санитизации перед передачей в SQL-запрос, что позволяет...

FLUIG-Vulnerabilidade-CVE-2023-6275

FLUIG-Vulnerabilidade-CVE-2023-6275 24 ноября 2023 — Уязвимость была обнаружена в TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. Она оценена как проблематичная. https://nvd.nist.gov/vuln/detail/CVE-2023-6275 CVE-2023-6275 - Отраженная межсайтовая подстановка сценариев в TOTVS Fluig Plataform 1.6.X...

CVE-2025-0133

CVE-2025-0133 Palo Alto PAN-OS XSS réfléchi dans la gateway et le portail GlobalProtect, gestionnaire getconfig.esp. Le paramètre user est reflété non encodé dans la page du portail captif ; un attaquant qui amène un utilisateur GlobalProtect authentifié vers un lien conçu peut exécuter du...

CVE-2026-24061-setup

Mise en place de CVE-2026-24061 Ce dépôt contient la configuration Docker pour CVE-2026-24061. Une fois Docker installé, procédez simplement comme suit : 1. Clonez ce dépôt. 2. Exécutez la commande suivante : sudo docker build . --tag telnetd-auth-bypass 3. Une fois l’image Docker construite, nou...

CVE-2024-1512

CVE-2024-1512 Preuve de concept Aperçu de la vulnérabilité CVE-2024-1512 expose une vulnérabilité critique dans le plugin WordPress MasterStudy LMS, plus précisément dans l'implémentation de la route REST /lms/stm-lms/order/items. Le problème provient de l'incapacité du plugin à échapper...

PT-2026-91828

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-85513

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

EUVD-2026-71087

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-43621

Simple Machines Forum (SMF) through 2.1.7 contains an authorization state-confusion vulnerability in the profile loader (Profile::load()). By supplying multiple values for the user parameter, an authenticated low-privileged user can exploit a mismatch between Profile::$member and User::$me->is...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-43621: Incorrect Authorization

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-78171 itsourcecode Sales and Inventory System processlogin.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit...

EUVD-2026-42506

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the updateuser function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific...