ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

CVE-2018-12463

CVE-2018-12463 XML external entity XXE vulnerability in /ssc/fm-ws/services in Fortify Software Security Center SSC 17.10, 17.20 & 18.10 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request.. Exploit-DB...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

wordpress_cve-2021-29447

wordpresscve-2021-29447 WordPress XXE vulnerability Credit : https://github.com/motikan2010...

ZimbraExploit

ZimbraExploit K8Cscan调用Zimbra8.8.11远程代码执行漏洞GetShell https://www.cnblogs.com/k8gege/p/10822908.html CVE-2019-9621 Zimbra8.8.11 XXE GetShell Exploit...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE mediante la carga de imágenes SVG Código del programa Python Flask + analizador XML root@kitploit: xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST...

CVE-2017-10617

CVE-2017-10616 & CVE-2017-10617 Estas dos vulnerabilidades afectan a Juniper Contrail versiones 2.2, 3.0, 3.1 y 3.2: Credenciales codificadas CVE-2017-10616 Entidad Externa XML CVE-2017-10617 El boletín de seguridad del fabricante se puede encontrar en Juniper Security Alert JSA10819 2017-10. El...

dnsbin

dnsbin The request.bin of DNS request DNSBin is a simple tool to test data exfiltration through DNS and help test vulnerability like RCE or XXE when the environment has significant constraint. The project is in two parts, the first one is the web server and it's component. It offers a basic web U...

CVE-2024-34102

CVE-2024-34102 - Exploit XXE CosmicSting Exploit para CVE-2024-34102 CosmicSting - Vulnerabilidad de XXE XML External Entity en Adobe Commerce y Magento. 📋 Acerca de la vulnerabilidad CVE-2024-34102 es una vulnerabilidad crítica de XXE XML External Entity que afecta a: Adobe Commerce versiones...

hopgoblin

hopgoblin hopgoblin es un escáner para instancias de Adobe Experience Manager AEM. Automatiza una serie de comprobaciones que realizamos con frecuencia manualmente durante evaluaciones de seguridad. Características Detecta endpoints expuestos de QueryBuilder: /bin/querybuilder.json...

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

Citrix StoreFront Server - XML External Entity

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. id: CVE-2019-13608 info: name: Citrix StoreFront Server - XML External Entity author: daffainfo severity: high description: | Citrix StoreFront Server before 1903, 7.15 LTSR...

VMWare Cloud Foundation NSX-V - XML External Entity (XXE)

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...

LabKey Server 19.1.0 - XML External Entity (XXE)

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read. id: CVE-2019-9757 info: name: LabKey Server 19.1.0 - XML External Entity XXE author: ritikchaddha...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

LumisXP <10.0.0 - Blind XML External Entity Attack

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XML external entity XXE attacks via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service. id:...

FreeIPA - XML Entity Injection

Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. id: CVE-2022-2414 info: name: FreeIPA - XML Entity Injection...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

Bughound

What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...