闪电博 Security Vulnerabilities

Exploit for Expression Language Injection in Vmware Spring Cloud Gateway

CVE-2022-22947 memshell 此脚本不完善,仅作学习用途,请勿非法使用 基于...

Exploit for Code Injection in Vmware Spring Framework

CVE-2022-22965-rexbb springboot core...

Exploit for Expression Language Injection in Vmware Spring Cloud Function

CVE-2022-22963 (spring cloud function sple rce) spring...

Exploit for CVE-2023-2982

CVE-2023-2982 WordPress Social Login and Register (Discord,...

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax...

Exploit for Vulnerability in Ncast Project Ncast

cve-2024-0305exp cve-2024-0305可用的exp，如需引用请转明出处，感谢！ 0x01...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Solr

Apache-Solr-RCE_CVE-2023-50386_POC Apache Solr Backup/Restore...

CVE-2023-26531

Cross-Site Request Forgery (CSRF) vulnerability in 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 plugin <= 4.2.7...

Exploit for Infinite Loop in Openssl

CVE-2022-0778 The discovered vulnerability triggers an...

Exploit for Improper Initialization in Linux Linux Kernel

CVE-2022-0847 Dirty Pipe linux内核提权分析 [toc]...

Arbitrary File Read Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-08160)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...

Exploit for Off-by-one Error in Sudo Project Sudo

CVE-2021-3156 [toc] 漏洞简介 漏洞编号: CVE-2021-3156...

Command Injection Vulnerability in DIR-822+ V1.0.2 of AUO Electronic Equipment (Shanghai) Co.

DIR-822 is a wireless router from D-Link, a Chinese company. A command injection vulnerability exists in the AUO Electronic Devices (Shanghai) Co. DIR-822+ version V1.0.2, which stems from the SetStaticRouteSettings function failing to correctly filter constructor command special characters,...

Exploit for Improper Input Validation in Microsoft

noPac 这个项目的由来是出于对 noPac 的原理学习, 在...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-43297 漏洞描述 Dubbo Hessian-Lite...

Information leakage vulnerability in the electronic document security management system of Beijing Yisaitong Technology Development Co., Ltd (CNVD-2023-86622)

Beijing Yisetong Technology Development Co., Ltd. is a leading data security business provider in China. An information leakage vulnerability exists in the electronic document security management system of Beijing Yisetong Technology Development Co., Ltd, which can be exploited by attackers to...

CVE-2023-26531 WordPress 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 Plugin <= 4.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 plugin &lt;= 4.2.7...

Exploit for Path Traversal in Lanproxy Project Lanproxy

Lanproxy 目录遍历漏洞 CVE-2021-3019 漏洞描述...

Exploit for Vulnerability in Microsoft

产生原因：对比202209和202307的AFD.sys,在函数AfdNotifyRemoveIOCompletion中，202......

Authentication Bypass Vulnerability in DSL-224 Version 3.0.10 of AUO Electronic Equipment (Shanghai) Co.

Ltd. DSL-224 is a wireless router from D-Link, a Chinese company. An authentication bypass vulnerability exists in the AUO DSL-224 version 3.0.10, which stems from an improper restriction of too many authentication attempts. An attacker could exploit the vulnerability to cause authentication...

Exploit for Use After Free in Linux Linux Kernel

fork from https://github.com/veritas501/hbp_attack_demo...

Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play

Spyware masquerading as modified versions of Telegram have been spotted in the Google Play Store that's designed to harvest sensitive information from compromised Android devices. According to Kaspersky security researcher Igor Golovin, the apps come with nefarious features to capture and...

Arbitrary File Download Vulnerability in ES File Browser of Beijing Xiaoxiong Bowang Technology Co.

ES File Explorer is a powerful and free local and network file manager. ES File Browser has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive...

Logic flaw vulnerability in n5 of the Nanqiong examination system (CNVD-2023-59091)

Nanqiong Exam System n5 is a handheld learning system that realizes online practice, mode exam, exam and result inquiry in one. A logic flaw vulnerability exists in Nanqiong Exam System n5, which can be exploited by an attacker to log into the system and obtain sensitive...

Exploit for CVE-2023-34960

Chamilo__CVE-2023-34960_RCE Chamilo 是一个电子学习平台，也称为学习管理系统...

IBOS OA SQL Injection Vulnerability

IBOS is a collaborative office management system. A SQL injection vulnerability exists in IBOS OA version 4.5.5, which originates from the lack of validation of the parameter id in the component Add User Handler against externally entered SQL statements, and can be exploited by an attacker to...

Flying Spin eBook Reader Windows Client has xss Vulnerability

Fly Turn eBook Reader is a powerful tool for reading and managing eBooks. An xss vulnerability exists in the Windows client of FlyTurn eBook Reader, which can be exploited by an attacker to obtain user cookie...

Unauthorized Access Vulnerability in Esaote Electronic Document Security Management System

Yisetong Electronic Document Security Management System is an electronic document security encryption software. There is an unauthorized access vulnerability in Yisetong Electronic Document Security Management System, which can be exploited by attackers to obtain sensitive...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-27550)

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A SQL injection...

Exploit for Improper Initialization in Linux Linux Kernel

CVE-2022-0847-DirtyPipe 漏洞简介 3 月 7 日，国外的安全研究员 Max...

Exploit for Improper Initialization in Linux Linux Kernel

title: CVE-2022-0847(DirtyPipe本地提权)漏洞分析 date: 2022-03-08...

S-CMS cross-site scripting vulnerability in Zibo Shining Network Technology Co.

S-CMS is a PHP and MySQL-based content management system (CMS) from S-CMS China. A security vulnerability exists in S-CMS Government Station Building System v5.0, which can be exploited by attackers to execute cross-site scripting attack (XSS) via...

S-CMS Cross-Site Scripting Vulnerability in Zibo Shining Network Technology Co.

S-CMS is a PHP and MySQL based content management system (CMS) from Zibo Shining Network Technology Co., Ltd. in China. A security vulnerability exists in S-CMS Government Station Building System v5.0, which can be exploited by attackers to perform cross-site scripting attacks...

Delta Electronics DIAEnergie descr parameter cross-site scripting vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...

Delta Electronics DIAEnergie HandlerEnergyType Parameter Name Cross-Site Scripting Vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...

Delta Electronics DIAEnergie .NET Request.QueryString Cross-Site Scripting Vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...

Delta Electronics DIAEnergie name parameter cross-site scripting vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...

Owowa: the add-on that turns your OWA into a credential stealer and remote access panel

While looking for potentially malicious implants that targeted Microsoft Exchange servers, we identified a suspicious binary that had been submitted to a multiscanner service in late 2020. Analyzing the code, we determined that the previously unknown binary is an IIS module, aimed at stealing...

About the security content of macOS Monterey 12.0.1

About the security content of macOS Monterey 12.0.1 This document describes the security content of macOS Monterey 12.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

S-CMS Access Control Error Vulnerability

S-CMS is a PHP and MySQL-based content management system (CMS) from S-CMS, a Chinese company. S-CMS suffers from an access control error vulnerability, which originates from an unauthorized access vulnerability in CMS Enterprise Website Construction System 5.0. An attacker can use this...

About the security content of macOS Big Sur 11.6

About the security content of macOS Big Sur 11.6 This document describes the security content of macOS Big Sur 11.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

DIAEnergie SQL Blind Injection Vulnerability (CNVD-2021-93913)

A SQL blind injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter agid before using the value as part of a...

DIAEnergie Certification Bypass Vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to an authentication bypass in DIAEnergie 1.7.5 and earlier. An attacker could use this vulnerability to add a new administrative user without authentication or authorization to be able to log in and use the...

DIAEnergie weak hash algorithm vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to a weak hash algorithm vulnerability in DIAEnergie 1.7.5 and earlier versions. An attacker could exploit this vulnerability to retrieve plaintext...

DIAEnergie SQL Blind Bet Vulnerability

A SQL blind injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter keyword before using the value as part of a SQL...

DIAEnergie SQL Blind Injection Vulnerability (CNVD-2021-93916)

A SQL blind injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter egyid before using the value as part of a...

DIAEnergie File Upload Vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to a file upload vulnerability in DIAEnergie 1.7.5 and earlier versions. An attacker could exploit this vulnerability to achieve remote code...

DIAEnergie Cross-Site Request Forgery Vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to cross-site request forgery in DIAEnergie 1.7.5 and earlier versions. An attacker could exploit this vulnerability to perform unauthorized...

DIAEnergie SQL Blind Injection Vulnerability (CNVD-2021-93914)

A SQL blind injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via parameter type before using the value as part of an SQL...

WordPress 博客社交分享组件 plugin <= 1.4.5 - Plugin's Setting Update via Cross-Site Request Forgery (CSRF) vulnerability

Plugin's Setting Update via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress 博客社交分享组件 plugin (versions &lt;= 1.4.5). Solution Deactivate and delete. This plugin has been closed as of September 26, 2021 and is not available for download. Reason: Security...