CVE-2020-14066

CVE-2020-14066 Icewarp 邮件服务器 12.3.0.1 权限不安全 https://nvd.nist.gov/vuln/detail/CVE-2020-14066...

MCPJam-Inspector-1.4.2-Remote-Code-Execution-CVE-2026-23744

Kali Linux上 - ターミナル1 nc -lvnp 4444 Kali Linux上 - ターミナル2 python3 ./CVE-2026-23744.py -t http://TARGET.com -p 4444 -i YOUR-KALI-LINUX-IP...

NextJS-Exploit-

NextSploit：Next.js CVE-2025-29927 扫描与利用工具 NextSploit 是一款命令行工具，专门用于检测和利用 CVE-2025-29927 ，这是 Next.js 中的一个安全漏洞。该工具首先识别目标网站是否运行 Next.js，并判断其版本是否在易受攻击范围内。如果确认网站存在漏洞，工具将自动尝试利用该问题 ，通过绕过中间件保护，可能获得对受限页面的未授权访问。 功能特性 自动 Next.js 版本检测 ：使用 Wappalyzer 检查目标网站是否运行 Next.js，并获取其版本。 漏洞评估 ：判断检测到的版本是否位于已知的易受攻击范围内。...

MikroTik-RouterOS-6.49.18-Exploit-Kit

MikroTik-RouterOS-6.49.18-Exploit-Kit 📋 MikroTik RouterOS 6.49.18 Exploit Kit 项目摘要 🎯 概述 已创建了一个专业且全面的项目，用于渗透 MikroTik RouterOS 6.49.18 设备，包含所有必需组件、完整的阿拉伯语界面和详细文档。 ✅ 已完成的组件 1️⃣ 渗透脚本 7 个脚本 ✅ 主要特性 1🎯 支持 CVE-2023-30799 阅读该工具的完整摘要指南 PROJECTSUMMARY.md...

CVE-2021-4044

SSL Checker 脚本 此仓库包含一个 Python 脚本，用于检查系统上的 OpenSSL 版本并测试与用户提供网站的 SSL/TLS 连接。该脚本旨在识别系统是否受到 CVE-2021-4044 影响，并测试连接过程中 SSL 错误的处理情况。 功能 OpenSSL 版本检查： 脚本检查系统上安装的 OpenSSL 版本，并在易受 CVE-2021-4044 影响时发出警报。 SSL 连接测试： 尝试与用户提供的网站建立 SSL 连接，处理并报告发生的任何 SSL 错误。 用户输入： 脚本提示用户输入目标网站 URL 以进行 SSL 连接测试。 前提条件 Python 3.x：...

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

DataEase - Remote Code Execution

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

XiongMai uc-httpd 1.0.0 - Buffer Overflow

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. id: CVE-2018-10088 info: name: XiongMai uc-httpd 1.0.0 - Buffer Overflow author: 0xAkoko severity: critical description: | Buffer overflow in XiongMai uc-httpd 1.0....

IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection

IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. id: CVE-2019-4716 info: name: IBM Planning Analytics - Authentication Bypass & Remote...

VMware NSX SD-WAN Edge - Command Injection

VMware NSX SD-WAN Edge formerly VeloCloud Edge before 3.1.2 contains an unauthenticated command injection in the local web UI diagnostic tools Ping/Traceroute. This template detects it reliably by injecting 'id', 'whoami', and a random marker. id: CVE-2018-6961 info: name: VMware NSX SD-WAN Edge ...

Atom CMS v2.0 - SQL Injection

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. id: CVE-2022-24223 info: name: Atom CMS v2.0 - SQL Injection author: theamanrawat severity: critical description: | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php...

Gradio - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

XWiki - Open Redirect

XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0. id: CVE-2023-32068 info: name: XWiki - Open Redirect author:...

LearnPress <= 4.2.5.7 - SQL Injection

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

mac0352-ep4

mac0352-ep4 Apache HTTP Server 2.4.23 漏洞研究（CVE-2016-8740）...

Security Bulletin: Due to use of NodeJS, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Due to use of NodeJS libraries, IBM Cloud Pak System Software is affected by multiple vulnerabilities. These have been addressed in IBM Cloud Pak System Software version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-22036 DESCRIPTION: Undici is an HTTP/1.1 client for Node.js. Prior to...

CVE-2025-11844-smolagents

🔐 Smolagents XPathインジェクションシミュレーションフレームワーク CVE-2025-11844 Hugging Faceのsmolagentsライブラリ（バージョン1.2.0まで）で発見されたXPathインジェクション脆弱性を実証する、教育用監査サンドボックスおよび動的Proof-of-Conceptスキャナーです。 🔍 脆弱性プロファイル 指標| 詳細 ---|--- CVE ID| CVE-2025-11844 対象コンポーネント| visionwebbrowser.py内のsearchitemctrlf関数 脆弱性タイプ| 不適切な入力検証 -...

CVE-2012-2122-Home-Lab

CVE-2012-2122 MySQL 認証バイパス ホームラボ このラボは、CVE-2012-2122 - MySQL 認証バイパス の脆弱性をデモンストレーションするものです。 MySQL 5.5.23 以前のバージョンにおけるパスワード比較のエラーが原因で発生します。 攻撃者が間違ったパスワードを繰り返し送信すると、MySQL が誤ってログインを許可してしまう可能性があります。 特徴 vulhub/mysql:5.5.23 をベースに使用 entrypoint.sh スクリプトでフラグを自動生成 フラグは /tmp/flag.txt に配置 docker restart...