CVE-2009-1151
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Github link:
https://github.com/mr-won/ZmEu
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
Github link:
https://github.com/mr-won/ZmEu
GitHub
GitHub - mr-won/ZmEu: CVE-2009-1151, phpMyAdmin의 set.up
CVE-2009-1151, phpMyAdmin의 set.up . Contribute to mr-won/ZmEu development by creating an account on GitHub.
CVE-2021-4045
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
Github link:
https://github.com/DorskFR/tapodate
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
Github link:
https://github.com/DorskFR/tapodate
GitHub
GitHub - DorskFR/tapodate: Sets up a local Tapo C200 using CVE-2021-4045
Sets up a local Tapo C200 using CVE-2021-4045. Contribute to DorskFR/tapodate development by creating an account on GitHub.
CVE-2024-36991
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
Github link:
https://github.com/TcchSquad/CVE-2024-36991-Tool
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
Github link:
https://github.com/TcchSquad/CVE-2024-36991-Tool
GitHub
GitHub - TcchSquad/CVE-2024-36991-Tool: This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests…
This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analys...
CVE-2024-25600
Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.
Github link:
https://github.com/so1icitx/CVE-2024-25600
Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.
Github link:
https://github.com/so1icitx/CVE-2024-25600
GitHub
GitHub - so1icitx/CVE-2024-25600: Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes…
Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes arbitrary code remotely. - so1icitx/CVE-2024-25600
CVE-2019-9053
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
Github link:
https://github.com/so1icitx/CVE-2019-9053
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
Github link:
https://github.com/so1icitx/CVE-2019-9053
GitHub
GitHub - so1icitx/CVE-2019-9053: Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts…
Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts admin creds with time-based SQLi. - so1icitx/CVE-2019-9053
CVE-2024-36991
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
Github link:
https://github.com/gunzf0x/CVE-2024-36991
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
Github link:
https://github.com/gunzf0x/CVE-2024-36991
GitHub
GitHub - gunzf0x/CVE-2024-36991: Proof of Concept for CVE-2024-36991. Path traversal for Splunk versions below 9.2.2, 9.1.5, and…
Proof of Concept for CVE-2024-36991. Path traversal for Splunk versions below 9.2.2, 9.1.5, and 9.0.10 for Windows which allows arbitrary file read. - gunzf0x/CVE-2024-36991
CVE-2018-10562
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
Github link:
https://github.com/mr-won/backdoor.mirai.helloworld
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
Github link:
https://github.com/mr-won/backdoor.mirai.helloworld
GitHub
GitHub - mr-won/backdoor.mirai.helloworld: backdoor.mirai.helloworld cve2018-20561, cve-2018-10562
backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 - mr-won/backdoor.mirai.helloworld
CVE-2023-21554
Microsoft Message Queuing Remote Code Execution Vulnerability
Github link:
https://github.com/leongxudong/MSMQ-Vulnerbaility
Microsoft Message Queuing Remote Code Execution Vulnerability
Github link:
https://github.com/leongxudong/MSMQ-Vulnerbaility
GitHub
GitHub - leongxudong/MSMQ-Vulnerbaility: Documentation and PoC for CVE-2023-21554 MSMQ Vulnerability
Documentation and PoC for CVE-2023-21554 MSMQ Vulnerability - leongxudong/MSMQ-Vulnerbaility
CVE-2023-32784
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
Github link:
https://github.com/G4sp4rCS/CVE-2023-32784-password-combinator-fixer
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
Github link:
https://github.com/G4sp4rCS/CVE-2023-32784-password-combinator-fixer
GitHub
GitHub - G4sp4rCS/CVE-2023-32784-password-combinator-fixer: After using the KeePass password dumper maybe some character parsed…
After using the KeePass password dumper maybe some character parsed as ● is incorrect and you want to know the real character - G4sp4rCS/CVE-2023-32784-password-combinator-fixer
CVE-2013-3900
The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."
Github link:
https://github.com/piranhap/CVE-2013-3900_Remediation_PowerShell
The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."
Github link:
https://github.com/piranhap/CVE-2013-3900_Remediation_PowerShell
GitHub
GitHub - piranhap/CVE-2013-3900_Remediation_PowerShell: Script to make changes on registry to fix CVE-2013-3900. It comes with…
Script to make changes on registry to fix CVE-2013-3900. It comes with an option to undo in case it breaks something on your environment. - GitHub - piranhap/CVE-2013-3900_Remediation_PowerShell: ...
CVE-2023-5561
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Github link:
https://github.com/rootxsushant/CVE-2023-5561-POC-Updated
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Github link:
https://github.com/rootxsushant/CVE-2023-5561-POC-Updated
GitHub
GitHub - rootxsushant/CVE-2023-5561-POC-Updated: Updated POC for Unauth Post Author Email Disclosures WordPress CVE-2023-5561
Updated POC for Unauth Post Author Email Disclosures WordPress CVE-2023-5561 - rootxsushant/CVE-2023-5561-POC-Updated