漏洞标题 CVE-2022-3481: NotificationX Dropshipping < 4.4 - SQL Injection 漏洞描述 The plugin does not properly sanitise and escape a parameter before using it in a SQL statement...

漏洞标题 CVE-2022-47945: Thinkphp Lang - Local File Inclusion 漏洞描述 ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack fe...

漏洞标题 CVE-2022-34048: Wavlink WN-533A8 - Cross-Site Scripting 漏洞描述 Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the login_...

漏洞标题 CVE-2022-22963: Spring Cloud Function SPEL 远程命令执行漏洞 漏洞描述 Spring Cloud Function 是基于Spring Boot 的函数计算框架，它抽象出所有传输细节和基础架构，允许开发人员保...

漏洞标题 CVE-2022-2383: WordPress Feed Them Social <3.0.1 - Cross-Site Scripting 漏洞描述 WordPress Feed Them Social plugin before 3.0.1 contains a reflected cross-site scriptin...

漏洞标题 CVE-2022-32409: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion 漏洞描述 Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local ...

漏洞标题 CVE-2022-42475: Fortinet SSL-VPN - Heap-Based Buffer Overflow 漏洞描述 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2....

漏洞标题 CVE-2022-41352: Zimbra Collaboration - Unrestricted File Upload 漏洞描述 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbit...

漏洞标题 CVE-2022-43185: Rukovoditel <= 3.2.1 - Cross-Site Scripting 漏洞描述 A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=gl...

漏洞标题 CVE-2022-25481: ThinkPHP 5.0.24 - Information Disclosure 漏洞描述 ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINF...

漏洞标题 CVE-2022-2627: WordPress Newspaper < 12 - Cross-Site Scripting 漏洞描述 WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitiz...

漏洞标题 CVE-2022-24706: CouchDB Erlang Distribution - Remote Command Execution 漏洞描述 In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default inst...

漏洞标题 CVE-2022-1388: F5 BIG-IP iControl REST Auth Bypass RCE 漏洞描述 This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through t...

打开题目就是一段代码，我们稍微美化一下，看的清楚点 I put something in F12 for you include 'flag.php'; $flag='MRCTF{xxxxxxxxxxxxxxxxxxxxxxxxx}'; if(isset($_GET['gg'])&&isset...

打开题目，这个图片还是很离谱的啊 改题解题思路见buu刷题总集第4关教程 最终flag为flag{6ba9e060-41af-4e20-9304-8d3855e1e3ae}

CheckIn题目分析 首先我们来看一下题目，首页就是一个简单的上传界面： 我们先上传一个php文件试一下，显然是illegal的 经过fuzz发现修改content-type和利用特殊扩展名php5、pht等都没有成功（...