CVE-2024-50395

CVE-2024-50395 Информация об уязвимости Сообщается, что уязвимость обхода авторизации через контролируемый пользователем ключ затрагивает надстройку Media Streaming. При эксплуатации уязвимость может позволить злоумышленникам в локальной сети получить привилегии. Мы уже исправили уязвимость в...

CVE-2025-9816

CVE-2025-9816 WP-Statistics 플러그인의 Stored XSS 취약점 스캐너 탐지 및 PoC "WordPress용 WP Statistics – 가장 인기 있는 개인정보 보호 친화적 분석 플러그인 플러그인은 입력 검증 및 출력 이스케이프가 충분하지 않아 14.5.4를 포함한 모든 버전에서 User-Agent 헤더를 통한 저장형 교차 사이트 스크립팅Stored Cross-Site Scripting에 취약합니다. 이로 인해 인증되지 않은 공격자가 임의의 웹 스크립트를 페이지에 주입할 수 있으며, 사용자가 해당 주입...

CVE-2014-6271-Apache-Debian

CVE-2014-6271-Apache-Debian Обзор Этот репозиторий является средой PoC для CVE-2014-6271. Вы можете развернуть веб-сервис, включающий уязвимость, используя образ контейнера apache2. Подготовка Сборка образа Соберите небезопасный образ из Dockerfile. root@kitploit: docker build -t...

CVE-2021-44228

CVE-2021-44228 Utilisation de la bibliothèque Log4j 2.14 Vulnérable dans User-Agent, méthode POST et point d'entrée /admin/cores?foo= Je l'ai téléversé sur Docker Hub : vous pouvez le tirer et l'exécuter https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

php-8.1.0-dev-backdoor-rce

PHP 8.1.0-dev 后门远程代码执行 PHP 8.1.0-dev 后门系统 Shell 脚本 PHP 8.1.0-dev 版本于 2021 年 3 月 28 日发布时内置了一个后门，但该后门很快被发现并移除。如果服务器运行此版本的 PHP，攻击者可通过发送 User-Agentt 头来执行任意代码。 问题被发现后，原始代码已被恢复，但随后又遭到第二次篡改。该入侵会在任何运行了被篡改版本 PHP 的网站上创建后门，使黑客能够在站点上执行远程代码。 阅读完整文章：https://flast101.github.io/php-8.1.0-dev-backdoor-rce/ POC 脚本...

docker_CVE-2014-6271.

dockerCVE-2014-6271. 1. docker build -t DOCKERIMAGENAME /path/to/dockerfiledirectory 2. docker run -it -d -p 8080:80 DOCKERIMAGENAME 3. 使用以下命令验证执行情况：docker ps 4. 验证 Web 服务器运行情况：http://localhost:8080 5. 利用漏洞： curl -H "user-agent: :; ; echo; echo; /bin/bash -c 'cat /etc/passwd'"...

CVE-2024-46982-Reproduction

शुरू करना 1. Node.js LTS स्थापित करें 2. npm install 3. npm run build 4. npm run start शोषण 1: कैश पॉइज़निंग के माध्यम से संग्रहीत XSS 1. किसी भी HTTP क्लाइंट का उपयोग करके निम्नलिखित HTTP अनुरोध हमला अनुरोध भेजें। root@kitploit: GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent:...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Beschreibung CVE-2026-54806 ist eine kritische CVSS 9.8 nicht authentifizierte PHP-Objekt-Injection-Schwachstelle im WP Activity Log WordPress Plugin wp-security-audit-log von Melapress. Ein nicht authentifizierter Angreifer kann...

vaas-cve-2014-6271

Vulnérabilité en tant que service - CVE 2014-6271 Un système Linux Debian Buster avec une version vulnérable de bash et une application web pour démontrer CVS-2014-6271, également connue sous le nom de Shellshock. Aperçu Ce conteneur Docker est basé sur Debian Buster et a été modifié pour utilise...

CVE-2021-42697

Akka HTTP 10.1.x 版本（早于 10.1.15）和 10.2.x 版本（早于 10.2.7）在解析 HTTP 头时可能遇到栈耗尽问题，从而允许远程攻击者通过发送带有深层嵌套注释的 User-Agent 头来实施拒绝服务攻击。 参考 MITRE Akka 博客 注释的任意嵌套 Akka 基本设置指南 PoC 说明 测试版本：10.2.4 目标服务器指纹：akka-http/ 负载片段：User-Agent:...

Log4J-Log4Shell-CVE-2021-44228-Spring-Boot-Test-Service

CVE-2021-44228 Servizio di test Spring Boot Questo è un progetto hello world spring boot fatto con un hack sporco per testare localmente i tuoi strumenti/payload/capacità di rilevamento prima di colpire i target di produzione con essi. La versione di Log4j configurata è 2.13.0 Creazione...

CVE-2026-76564

XSS memorizzato tramite User-Agent nella vista dell'ordine dell'amministratore in PhocaCart PhocaCart ≤ 6.1.7 — Un attaccante non autenticato memorizza un payload XSS tramite il checkout. Si esegue nel contesto del browser dell'amministratore SOMMARIO PhocaCart 6.1.7 per Joomla memorizza l'header...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

CVE-2026-76564

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

EUVD-2026-63215

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564

PhocaCart (Joomla extension) versions 5.0.0–6.1.7 are affected by a Stored XSS (CWE-79) in the admin order view. When the non-default store_user_agent option is enabled, the raw User-Agent header from checkout requests is stored unsanitized in the orders database and rendered without HTML encodin...

CVE-2026-66832

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

CVE-2026-66832

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

EUVD-2026-56978

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...