CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ 然后查看该作者发布的文章以触发XSS。 视频POC： https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2026-107573

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 on Windows suffer from incorrect default permissions in the installer. The installer creates data, log, temp, database, and event folders, along with the hMailServer.INI configuration file, using permissions inherited from the installatio...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

EUVD-2026-94855

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

phishlulz

PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...

CVE-2026-104671

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

CVE-2017-12542

CVE-2017-12542 このスクリプトは、HP iLO サーバーが脆弱かどうかを確認し、管理者ユーザーを追加できます。...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2022-24086-RCE

CVE-2022-24086-RCE CVE-2022-24086 RCE Descripción Las versiones 2.4.3-p1 y anteriores y 2.3.7-p2 y anteriores de Adobe Commerce están afectadas por una vulnerabilidad de validación de entrada incorrecta durante el proceso de pago. La explotación de este problema no requiere interacción del usuari...

CVE-2026-24061

CVE-2026-24061-PoC ⚠ 이 도구는 교육 목적으로만 제작되었습니다. 통제된 환경 밖에서의 무단 사용은 엄격히 금지됩니다. CVE-2026-24061은 GNU Inetutils의 telnetd버전 1.9.3–2.7에 존재하는 치명적인 취약점CVSS 9.8으로, 원격 공격자가 USER 환경 변수를 통해 -f root를 전달하여 인증을 우회하고 루트 액세스 권한을 얻을 수 있습니다. 이 도구는 이 취약점의 악용을 시뮬레이션하기 위해 제작되었습니다. 요구 사항 Windows OS/Linux Python 3.4+ 사용 방법...

CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

CVE-2019-14530

CVE-2019-14530 OpenEMR 项目中的路径遍历和拒绝服务（DoS）漏洞 文件中的易受影响函数： /openemr/custom/ajaxdownload.php 条件： 1. 任意已授权用户 2. 对于 DoS 情形：服务器上必须存在目录 "/sites/default/documents/cqmqrda/"（由于 "unlink" 函数的逻辑，文件路径必须仅由已存在的目录及其中的文件组成。） 受影响版本： 5.0.2，已在 5.0.2 版本中修复。 描述 此函数中的易受影响变量：fileName，攻击者可以控制该变量，且没有任何过滤和验证。...

CVE-2023-23397

CVE-2023-23397 概念验证 这是 CVE-2023-23397 的概念验证 PoC 利用脚本，该漏洞存在于 Windows Microsoft Outlook 客户端中。 前提条件 Python 3 pywin32 包 使用方法 Windows 1. 通过运行 pip install pywin32 安装所需的 pywin32 包。 2. 使用以下命令运行脚本：python Exploit.py 。 Kali Linux 1. 通过运行 pip install pywin32 安装所需的 pywin32 包。 2. 在攻击者机器上启动一个 SMB 服务器，例如...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers

CVE-2025-44603（CSRF漏洞：导致创建虚假客户） 项目名称与仓库 URL :https://phpgurukul.com/client-management-system-using-php-mysql/ 漏洞名称 : 跨站请求伪造（CSRF） 受影响版本 : V1.2 简介 由 PHPGurukul 开发的客户管理系统的“添加客户”功能中存在跨站请求伪造（CSRF）漏洞。CSRF 是一种攻击方式，攻击者诱导已认证用户向 Web 应用程序提交恶意请求，从而可能导致以该用户身份执行未授权操作。在本报告中，我们演示了如何利用 CSRF 在 客户管理系统...

CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94810

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-12260 SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...