CVE-2016-10033

CVE-2016-10033 – PHPMailer 원격 코드 실행 📌 설명 이 저장소는 CVE-2016-10033 에 대한 개념 증명PoC 익스플로잇 코드를 포함하고 있습니다. 이는 PHPMailer 버전 5.2.18 미만 에서 발생하는 취약점입니다. 문제는 PHP 내장 mail 함수의 $additionalparameters 인수가 부적절하게 처리될 때 발생하며, 공격자가 sendmail 에 추가 명령줄 매개변수를 주입할 수 있게 됩니다. 이를 악용하여 웹 접근 가능 디렉토리에 임의의 PHP 코드를 작성할 수 있으며, 원격 코드...

cpx_proftpd

cpxproftpd CVE-2015-3306 악용을 위한 Daniel Aldana의 PoC입니다. 버그는 Vadim Melihow가 보고했습니다. 방법 1: 사용법: python cpxproftp.py 예: python cpxproftp.py 127.0.0.1 /etc/passwd /var/www/pass.txt 그런 다음 시도: http://127.0.0.1/pass.txt 방법 2: 사용법: python cpxproftp.py 예: python cpxproftp.py 127.0.0.1 /var/www/html 그런 다음 시...

CVE-2026-46393 HAXcms createSite SSRF Enables Arbitrary File Read

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery SSRF vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enablin...

HAXcms createSite SSRF Enables Arbitrary File Read

Summary An authenticated Server-Side Request Forgery SSRF vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Details The createSite endpoint in HAXcms...

GHSA-Q862-GCGQ-5M6G HAXcms createSite SSRF Enables Arbitrary File Read

Summary An authenticated Server-Side Request Forgery SSRF vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Details The createSite endpoint in HAXcms...

PT-2026-41975

Name of the Vulnerable Software and Affected Versions HAX CMS versions prior to 26.0.0 Description An authenticated Server-Side Request Forgery SSRF allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and...

PT-2025-47477

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated script-management endpoint at AudioCodes files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-suppli...