488150 matches found
CVE-2023-27350-POC
CVE-2023-27350-POC A python script tht searches for vulnerable version of PaperCut MF/NG More information can be found here: https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software Note: This was created for educational use only. Use at your own risk...
CVE-2024-51435
bloodbank A simple csrf poc found on blood bank system v 1.0...
CVE-2019-9787
CVE-2019-9787 CSRF PoC Overview PoC of CSRF CVE-2019-9787 WordPress Version 5.1.1 CVE-2019-9787 Do not use this, EXCEPT for TEST purpose. Installation docker-compose up -d Attack 1. Access http://localhost:8080/wp-admin/install.php and install WordPress. you only have to create WP admin account. ...
XWiki - Open Redirect
XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0. id: CVE-2023-32068 info: name: XWiki - Open Redirect author:...
Atom CMS v2.0 - SQL Injection
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. id: CVE-2022-24223 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...
Gradio - Server-Side Request Forgery
A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...
strapi CMS <3.0.0-beta.17.5 - Admin Password Reset
strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. id: CVE-2019-18818 info: name: strapi CMS 3.0.0-beta.17.5 - Admin Password Reset...
WP Helper Lite < 4.3 - Cross-Site Scripting
The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. id: CVE-2023-0448 info: name: WP Helper Lite 4.3 - Cross-Site Scripting author: ritikchaddha severity: medium description: | T...
WP Hotel Booking <= 2.0.7 - SQL Injection
WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...
LearnPress <= 4.2.5.7 - SQL Injection
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
DataEase - Remote Code Execution
DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...
n8n Webhooks - Remote Code Execution
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...
Nodejs Squirrelly - Remote Code Execution
Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...
CVE-2018-10933_ssh
CVE-2018-10933 to test this code: get vulnerable version of libssh at homepage: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz uncompress and build, then go to example directory, there's a simple sshd server using libssh name: samplesshd-cb run this simple sshd by command: $ samplesshd-cb...
CVE-2024-42834
Exploit Title: INCOGNITO SAC STORED CROSS-SITE SCRIPTING XSS VULNERABILITY Date: 26 JULY 2024 Exploit Author: Etienne Supra Vendor Homepage: https://www.incognito.com/products/service-activation-center/ Version: 14.11 CVE : CVE-2024-42834 Vendor has been informed and acknowledge the vulnerability...
CVE-2024-41312.
CVE-2024-41312. InstantCMS - Stored Cross Site Scripting XSS Affected Version: InstantCMS 2.16.3 Steps to Reproduce: 1. Log in to https://demo.instantcms.io as an demo user. 2. Visit https://demo.instantcms.io/photos/upload. 3. Upload the image with the embedded payload test in the Camera Model...
39646
39646 WordPress Plugin Advanced Video 1.0 - Local File Inclusion Update Original credit goes to evait security GmbH This script is a more robust version of the original exploit...
CVE-2016-10708
SSH NEWKEYS Flood PoC CVE-2016-10708 Description This proof-of-concept script exploits a vulnerability in OpenSSH versions prior to 7.4 CVE-2016-10708 by sending unexpected SSHMSGNEWKEYS packets which can result in DoS. It can operate in two modes: scan : Connects to one or more SSH servers,...