GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

CHIYU TCP/IP Converter - Cross-Site Scripting

CHIYU BF-430, BF-431 and BF-450M TCP/IP Converter devices contain a cross-site scripting vulnerability due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, and ppp.cgi. id: CVE-2021-31250 info: name: CHIYU TCP/IP Converter - Cross-Site Scripting author: geeknik...

Juiceshopgl

Juice Shop Logo OWASP Juice Shop Test Coverage Maintainability...

CVE-2002-0201

CVE-2002-0201 Il Cyberstop Web Server per Windows 0.1 consente ad attaccanti remoti di causare un denial of service crash e possibilmente eseguire codice arbitrario tramite una lunga richiesta HTTP GET, innescando possibilmente un buffer overflow. Pubblicazione su Exploit-db:...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 è una vulnerabilità critica nella funzionalità Web UI del software Cisco IOS XE, che consente a un aggressore remoto non autenticato di creare account con livello di privilegio 15 sui sistemi interessati, ottenendo così il controllo completo del dispositivo. La...

scout

Scout Scout is a URL fuzzer and spider for discovering undisclosed VHOSTS, files and directories on a web server. A full word list is included in the binary, meaning maximum portability and minimal configuration. Aim and fire! Usage root@kitploit: Usage: scout command Available Commands: help Hel...

CVE-2022-1388-Exploit

CVE-2022-1388-Exploit Script di test ed exploit per CVE-2022-1388 F5 Big-IP masscheck.py accetta un file di input e verifica se gli host sono vulnerabili senza sfruttarli. Rilevamento: Scansione di /mgmt/tm/util/bash come endpoint, probabilmente presente nei log del server web. Oppure, se hai un...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Proof of Concept di Iniezione di Comandi Descrizione della vulnerabilità: Le funzioni ping e traceroute del router NETIS SYSTEMS WF2409E versione V3.6.42541 sono suscettibili ad attacchi di iniezione di comandi. Input malevoli possono esse...

htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC vulnerabilità di command injection nel web server di alcuni prodotti Hikvision. A causa di una validazione dell'input insufficiente, un attaccante può sfruttare la vulnerabilità per lanciare un attacco di command injection inviando messaggi con comandi malevoli...

CVE-2022-24715

Icinga Web 2 - Esecuzione remota di codice autenticata 2.8.6, 2.9.6, 2.10 Esecuzione remota di comandi Reverse shell Utilizzo root@kitploit: usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL...

snuck

snuck Automatic XSS filter bypass Overview snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker and the victim...

CVE-2022-24638

AS SEEN ON EXPLOITDB: https://www.exploit-db.com/exploits/51026 DIESE VERSION WURDE BEHOBEN, UM FALSCH NEGATIVE ZU VERHINDERN CVE-2022-24637 Exploit für die nicht authentifizierte RCE in Open Web Analytics OWA 1.7.4. Diese Arbeit basiert auf https://devel0pment.de/?p=2494. HAFTUNGSAUSSCHLUSS:...

cve-2026-43515-poc

CVE-2026-43515 — Bypass delle restrizioni di sicurezza in Apache Tomcat Giudizio di sfruttabilità: confermato sfruttabile. Una richiesta POST verso una risorsa protetta da una configurazione con divisa bypassa completamente l'autenticazione. La struttura web.xml richiesta è poco comune nelle...

WebGoat.NET

Webgoat.NET الكود المصدري: https://github.com/jerryhoff/WebGoat.NET تحميل zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master تطبيق الويب هذا هو منصة تعليمية تحاول التعليم عن عيوب أمن الويب الشائعة. يحتوي على عيوب أمنية عامة تنطبق على معظم تطبيقات الويب. كما يحتوي على دروس تتعلق تحديدًا ...