漏洞标题 CVE-2022-0785: WordPress Daily Prayer Time <2022.03.01 - SQL Injection 漏洞描述 WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerab...

漏洞标题 (CVE-2021-26855) 微软Exchange服务器 远程代码执行漏洞 漏洞描述 (CVE-2021-26855) 微软Exchange服务器 远程代码执行漏洞 PoC代码 暂无

漏洞标题 CVE-2022-29014: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion 漏洞描述 Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclu...

漏洞标题 CVE-2010-1429: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure 漏洞描述 Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP0...

漏洞标题 CVE-2024-36401: GeoServer RCE in Evaluating Property Name Expressions 漏洞描述 In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC reque...

漏洞标题 CVE-2015-9414: WordPress Symposium <=15.8.1 - Cross-Site Scripting 漏洞描述 WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability v...

相关阅读 今天我们讲讲，如何通过json web token登录验证的一个漏洞来免费获取豪华会员 图文教程 我们发现用户在注册、登陆时，在payload中存在用户身份的信息，譬如非会员 再譬如豪华会员 这时...

解题思路 首先登陆页面发现是这样的： 查看源码源码很正常，也没有什么特别的web 目录扫描 获取到robots.txt下面有一个备份文件 <?php class UserInfo { public $name = ''; public $age = 0...

漏洞标题 CVE-2021-36748: PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection 漏洞描述 PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (b...

漏洞标题 CVE-2021-23241: MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion 漏洞描述 MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in co...

漏洞标题 CVE-2021-21345: XStream < 1.4.16 - Remote Code Execution 漏洞描述 XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights c...

1、以下面网站为例，密码为：qazwsx123，首先抓包，发现加密后的密码为：/BB3blYPP6yJ8QPgX1gkQA==，对应字段loginPwd 2、密码无法进行常规解码方式解开时，但是我们想对此处进行相关测试，比如...

漏洞标题 CVE-2017-18556: Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting 漏洞描述 The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issu...

漏洞标题 CVE-2024-35627: TileServer API - Cross Site Scripting 漏洞描述 tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the com...

漏洞标题 CVE-2024-4455: YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting 漏洞描述 The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross...

漏洞标题 CVE-2023-34755: bloofoxCMS v0.5.2.1 - SQL Injection 漏洞描述 bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/ind...