CVE-2024-31317

CVE-2024-31317 前言 前两天看到JD的公众号发了篇CVE-2024-31317漏洞的分析，通篇看下来感觉还是比较有意思，且车机目前主流方案均为安卓系统且都在该漏洞的有限范围内，遂开始复现。...

CVE-2024-48246

CVE-2024-48246 Vehicle Management System 1.0 - Cross-Site Scripting Almacenado XSS Descripción Vehicle Management System 1.0 contiene una vulnerabilidad de Cross-Site Scripting XSS Almacenado en el parámetro Name de /vehicle-management/booking.php. Un actor malicioso puede inyectar payloads...

CANalyse

CANalyse CANalyse 是一款用于分析日志文件以自动发现独特数据集，并能连接到如 Telegram 等简单用户界面的工具。基本而言，攻击者在使用此工具时可以提供机器人 ID，并通过 Telegram 机器人通过网络使用该工具。CANalyse 被设计为放置在树莓派内部，能够通过记录和分析网络流量/数据日志（就像植根于汽车中的硬件后门）来通过 Telegram 机器人利用车辆漏洞。 使用此工具的前提条件是硬件植入程序已安装在汽车中，并且能够与车辆内部的网络/通信通道进行通信。 此处有说明 ℹ️ Medium 博客 YouTube 工具布局 要求： Python3 pip3...

canTot

canTot canTot es un framework de CLI basado en Python, basado en sploitkit y fácil de usar porque es similar a trabajar con Metasploit. Es similar a un framework de exploits pero centrado en vulnerabilidades conocidas de CAN Bus o hacks divertidos de CAN Bus. También se puede usar como guía para...

AI and the Automobile

Open Arsenal AI 与汽车规范 AI 与汽车（AI and the Automobile）系列汇集了多项规范，定义了 AI 如何集成到现代车辆系统中。在整个系列中，它将汽车视为一个软件定义平台，智能分布于感知、控制、导航和能量管理层。这些规范强调实时计算约束、安全关键架构，以及从静态机械系统向持续演进的软件驱动出行的转变。 这些规范还共同概述了如何通过开放、可互操作的系统以及严格的安全实践来开发和维护汽车 AI。它们强调了协作开发模型、仿真与验证流程，以及人在回路监督，以确保边缘情况下的可靠性。该系列将车辆智能定义为一个分层系统，结合 AI...

CVE-2026-101109

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

CVE-2026-101109

The Joomla Extension - ordasoft.com - Vehicle Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.5.8 . The root cause is that the public vehicle-detail page (triggered by task=view) echoes the title request parameter directly into a double-quoted HTML attr...

EUVD-2026-88437

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

CVE-2026-101108

The Vehicle Manager (Free) Joomla extension by ordasoft.com is vulnerable to an unauthenticated SQL Injection in versions prior to 6.5.8 . The flaw exists in site/vehiclemanager.php, where the order_field and order_direction parameters are processed at three frontend entry points (category listin...

EUVD-2026-88432

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

CVE-2021-46074

CVE-2021-46074 Exploit Title: Vehicle Service Management System - 'Settings' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

CVE-2021-46071

CVE-2021-46071 Título del Exploit: Vehicle Service Management System - 'Category List' Cross Site Scripting XSS Almacenado Autor del Exploit: SANU P.L CVE: CVE-2021-46071 CVSS: 4.8 MEDIO Referencias:...

CVE-2021-46069

CVE-2021-46069 Exploit Title: 车辆服务管理系统 - 'Mechanic List' 存储型跨站脚本 XSS Exploit Author: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-46069...

CVE-2021-46078

CVE-2021-46078 漏洞利用标题：车辆服务管理系统 - 多处文件上传导致存储型跨站脚本攻击 漏洞利用作者：SANU P.L CVE：CVE-2021-46078 CVSS：4.8 中危 参考来源： https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-stored-cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2021-46078...

CVE-2021-46075

CVE-2021-46075 Título del Exploit: Sistema de Gestión de Servicios de Vehículos - 'Múltiples' escaladas de privilegios conducen a operaciones CRUD Autor del Exploit: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 ALTA Referencias:...

CVE-2021-46067

CVE-2021-46067 Título del Exploit: Vehicle Service Management System - 'Múltiple' Robo de Cookies Conduce a la Toma Total de la Cuenta Autor del Exploit: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRÍTICO Referencias:...

CVE-2021-46076

CVE-2021-46076 漏洞标题：车辆服务管理系统 - '多处' 文件上传导致代码执行 漏洞作者：SANU P.L CVE：CVE-2021-46076 CVSS：8.8 高危 参考文献： https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-code-execution https://nvd.nist.gov/vuln/detail/CVE-2021-46076 https://vulners.com/cve/CVE-2021-46076 描述：...

CVE-2021-46073

CVE-2021-46073 Título del Exploit: Vehicle Service Management System - 'User List' Cross Site Scripting Almacenado XSS Autor del Exploit: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIO Referencias: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

CVE-2021-46068

CVE-2021-46068 Título del Exploit: Vehicle Service Management System - Cross Site Scripting Almacenado XSS en 'MyAccount' Autor del Exploit: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIA Referencias: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...