338 matches found
Web Directory Free < 1.7.3 - Local File Inclusion
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include, which could lead to Local File Inclusion issues. id: CVE-2024-3673 info: name: Web Directory Free 1.7.3 - Local File Inclusion author: s4e-io severity: critical description: | The Web...
CentralSquare CryWolf - Path Traversal
A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf False Alarm Management through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information. id: CVE-2024-45241 info:...
CVE-2016-10033
CVE-2016-10033 – PHPMailer Remote Code Execution 📌 Description This repository contains a proof-of-concept PoC exploit for CVE-2016-10033 , a vulnerability in PHPMailer versions prior to 5.2.18. The issue occurs when the $additionalparameters argument of PHP's built-in mail function is improperly...
urlbuster
root@kitploit: ██╗ ██╗██████╗ ██╗ ██████╗ ██╗ ██╗███████╗████████╗███████╗██████╗ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██║ ██║██████╔╝██║ ██████╔╝██║ ██║███████╗ ██║ █████╗ ██████╔╝ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██████╔╝██║...
cve-2020-3452
CVE-2020-3452-利用工具 仅供教育用途！ 只是一个基本的利用程序，滥用 CVE-2020-3452 来枚举 CISCO ASA/FTD 设备 Web 目录中可访问的标准文件。 用法： 默认情况下，此工具使用基于 Metasploit Framework 中 CVE-2018-0296 的示例输出构建的文件列表（https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/http/ciscodirectorytraversal.md）。...
Web Directory Free < 1.7.0 - SQL Injection
The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...
h2buster
h2buster v0.4d A fast, threaded, recursive, web directory brute-force scanner over HTTP/2 using hyper, inspired by Gobuster. Features Fast and portable - install hyper and run. Multiconnection scanning. Multithreaded connections. Scalable: scans can be as docile or aggressive as you configure the...
CrawlBox
CrawlBox | Easy way to brute-force web directory. Operating Systems Tested MacOSX Kali Linux Ubuntu 16.04 Usage root@kitploit: python crawlbox.py -h -v -w WORDLIST url positional arguments: root@kitploit: url specific target url, like domain.com optional arguments: root@kitploit: -h, --help show...
Eclipse Jetty ConcatServlet - Information Disclosure
Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...
CVE-2024-3673
CVE-2024-3673 CVE-2024-3673 利用：Web Directory Free WordPress 插件本地文件包含（低于 1.7.3 版本） 概述 CVE-2024-3673 描述了 Web Directory Free WordPress 插件（低于 1.7.3 版本）中的一个严重漏洞。该插件未能先验证参数就在 include 函数中使用该参数，导致本地文件包含（LFI）。这允许未经身份验证的攻击者读取服务器上的敏感文件。 受影响插件版本 受影响版本： --file 示例： root@kitploit: python3 CVE-2024-3673.py --url...
CVE-2026-59310
CVE-2026-59310 More root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...
cpx_proftpd
cpxproftpd PoC de Daniel Aldana para explotación de CVE-2015-3306. Error reportado por Vadim Melihow. MÉTODO 1: uso: root@kitploit: python cpxproftp.py ejemplo: root@kitploit: python cpxproftp.py 127.0.0.1 /etc/passwd /var/www/pass.txt luego prueba: root@kitploit: http://127.0.0.1/pass.txt MÉTODO...
CVE-2020-3452-Exploit
CVE-2020-3452-Exploit 只是利用CVE-2020-3452的基本漏洞利用工具，用于枚举CISCO ASA/FTD设备Web目录中可访问的标准文件。 Usage: 默认情况下，它使用从Metasploit Framework中CVE-2018-0296的示例输出构建的文件列表（https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/http/ciscodirectorytraversal.md）。 root@kitploit:...
cve-2024-3552
描述 Web Directory Free（WordPress）插件在 1.7.0 之前的版本存在 SQL 注入漏洞。AJAX 执行函数未经过充分的过滤/净化（sanitise），允许攻击者使 SQL 查询失效或注入额外的子句（UNION、时间型、报错型） 上下文 WordPress 版本 5.8 web-directory-free 插件版本 1.6.9 MySQL 版本 5.7 源代码 在文件 ajax-controller.php → 类 w2dcajaxcontroller → 函数 getmapmarkerinfo 中 1. 直接通过 $POST'locationsids'...
CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
EUVD-2026-57945
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-28142
The CVE describes an Unauthenticated SQL Injection in the WordPress plugin Web Directory Free for versions up to 1.7.13 . Root cause details are not explicitly provided in the documents beyond the vulnerability type, but the CVSS v3.1 base score is 9.3 (CRITICAL) with high impact on confidentiali...
