Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

qdPM 9.1 - Cross-site Scripting

qdPM V9.1 is vulnerable to Cross Site Scripting XSS via qdPM\install\modules\databaseconfig.php. id: CVE-2020-19515 info: name: qdPM 9.1 - Cross-site Scripting author: theamanrawat severity: medium description: | qdPM V9.1 is vulnerable to Cross Site Scripting XSS via...

OPNsense - Cross-Site Scripting

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-39002 info: name: OPNsense - Cross-Site Scripting author: Herry severity: medium description...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

Label Studio < 1.16.0 - Cross-Site Scripting

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Ricoh Web Image Monitor - Reflected XSS

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. id: CVE-2025-41393 info: name: Rico...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

ATutor < 2.2.1 - Cross Site Scripting

ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. id: CVE-2023-27008 info: name: ATutor 2.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | ATutor 2.2.1 was discovered with a vulnerability, a...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

FREEDOM Administration - Default Login

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires ma...

CVE-2021-21424

CVE-2021-21424 目录遍历与文件暴露 • CVE-2021-21424 • 描述：如果未在生产环境中禁用 WebProfiler，则会暴露服务器内部路径。 • 受影响版本：Symfony 2.8 到 5.x。 • 典型绕过方式：直接访问 /appdev.php/profiler/。 CVE-2021-21424 摘要 • CVE：2021-21424 • 组件：Web Profiler / Dev Toolbar • 影响：敏感信息泄露（环境、路径、参数） • 条件：/appdev.php、/profiler 或 /wdt 在生产环境中可访问。 •...

CVE-2025-29927-Proof-of-Concept

逐步教程 步骤 1（5 分钟） 提示 目标暴露了哪些网络服务？ — — — 解决方案 kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p 步骤 2（5 分钟） 提示 1 登录页面只显示了一个登录页面，但网络服务器通常还会暴露其他路径。 提示 2 尝试使用目录暴力破解工具，例如 Gobuster 或 DirBuster。 — — — 解决方案 kali@kali:$ gobuster dir -u http://:/ -w /usr/share/wordlists/dirb/common.txt...

WebShells

WebShells WebShell estudiando...

ai-agent-gateway

@tuskira/gateway-web Consola de administración para el Tuskira AI Agent Gateway. React 19 + Vite + TypeScript estricto + Tailwind CSS 4 + shadcn/ui. Desarrollo Requiere Node 26+ y npm 11+ no pnpm. npm install npm run dev El servidor de desarrollo redirige /api a http://localhost:8081 ver...

tulpar

Tulpar 是一款开源 Web 漏洞扫描器，旨在实现 Web 渗透测试的自动化。Tulpar 具有以下功能。 SQL 注入（GET 方法） XSS（GET 方法） 爬虫 电子邮件泄露 信用卡信息泄露 Whois 命令注入（GET 方法） 目录遍历（GET 方法） 文件包含（GET 方法） 服务器信息 技术信息 X-Content-Type 检查 X-XSS-Protection 检查 TCP 端口扫描 robots.txt 检查 URL 编码 证书信息 可用方法 网络威胁情报 IP2Location 文件输入可用性检查 安装： git clone...

SmartScanner-Source

SmartScanner Un escáner de vulnerabilidades web construido con C++17 y Qt 6, que incluye interfaces gráfica y de línea de comandos. Este repositorio contiene una reconstrucción de SmartScanner 3.0.0 con fines educativos. Combina un motor de rastreo web, módulos de detección de vulnerabilidades y...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirige a un sitio web arbitrario en este caso, https://example.com. patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

onioff

██████╗ ███╗ ██╗██╗ ██████╗ ███████╗███████╗ ██╔═══██╗████╗ ██║██║██╔═══██╗██╔════╝██╔════╝ ██║ ██║██╔██╗ ██║██║██║ ██║█████╗ █████╗ ██║ ██║██║╚██╗██║██║██║ ██║██╔══╝ ██╔══╝ ╚██████╔╝██║ ╚████║██║╚██████╔╝██║ ██║ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═════╝ ╚═╝ ╚═╝ v2.0 A simple tool - written in pure python - f...