漏洞标题 CVE-2021-24370: WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload 漏洞描述 WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbit...

漏洞标题 CVE-2024-23917: JetBrains TeamCity > 2023.11.3 - Authentication Bypass 漏洞描述 In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible...

漏洞标题 CVE-2021-24358: Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect 漏洞描述 WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate...

漏洞标题 CVE-2024-7714: AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls 漏洞描述 The plugin lacks sufficient access controls allowing an unauthenticated u...

漏洞标题 Apache Solr XXE漏洞(CVE-2017-12629) 漏洞描述 【漏洞对象】Apache Solr 【涉及版本】Apache Solr before 7.1.0 【漏洞描述】该漏洞可用于任何参数为deftype =xmlparser的查询请求，...

漏洞标题 CVE-2019-9978: WordPress Social Warfare <3.5.3 - Cross-Site Scripting 漏洞描述 WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerabilit...

漏洞标题 CVE-2021-24291: WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting 漏洞描述 WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflect...

漏洞标题 CVE-2022-26263: Yonyou U8 13.0 - Cross-Site Scripting 漏洞描述 Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An a...

漏洞标题 CVE-2024-28397: pyload-ng js2py - Remote Code Execution 漏洞描述 An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitr...

前言：一直以来在挖掘xss时总是被各种过滤，各种实体化转义。是真滴很难受，敢想连着几天兴冲冲奔着表单去，看着被过滤，转义的payload，用尽办法都过不去的心情。最后似乎有个声音在跟我说，能...

漏洞标题 CVE-2019-19825: TOTOLINK/Realtek Routers - CAPTCHA Bypass 漏洞描述 On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to t...

漏洞标题 CVE-2019-7238: NEXUS < 3.14.0 Remote Code Execution 漏洞描述 body="Nexus Repository Manager" app="Nexus-Repository-Manager" PoC代码

漏洞标题 CVE-2024-6586: Lightdash v0.1024.6 - Server-Side Request Forgery 漏洞描述 Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version...

本文转载于公众号：融云攻防实验室，原文地址： 漏洞复现 Jupyter Notebook 未授权访问远程命令执行漏洞 Jupyter Notebook（此前被称为 IPython notebook）是一个交互式笔记本，支持运行 40 多...

漏洞标题 CVE-2021-46419: Telesquare TLR-2855KS6 - Arbitrary File Deletion 漏洞描述 An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow...

漏洞标题 CVE-2024-51211: openSIS Classic v9.1 - SQL Injection 漏洞描述 SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.ph...