Aggregator

CVE-2025-5034 | wp-file-download Plugin up to 6.2.5 on WordPress cross site scripting

VulDB Recent Entries
1 month 3 weeks ago
A vulnerability, which was classified as problematic, was found in wp-file-download Plugin up to 6.2.5 on WordPress. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-5034. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-3629 | IBM InfoSphere Information Server up to 11.7.1.6 improper ownership management (EUVD-2025-18810)

VulDB Recent Entries
1 month 3 weeks ago
A vulnerability, which was classified as problematic, has been found in IBM InfoSphere Information Server up to 11.7.1.6. Affected by this issue is some unknown functionality. The manipulation leads to improper ownership management. This vulnerability is handled as CVE-2025-3629. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-3221 | IBM InfoSphere Information Server up to 11.7.1.6 allocation of resources (EUVD-2025-18811)

VulDB Recent Entries
1 month 3 weeks ago
A vulnerability classified as critical was found in IBM InfoSphere Information Server up to 11.7.1.6. Affected by this vulnerability is an unknown functionality. The manipulation leads to allocation of resources. This vulnerability is known as CVE-2025-3221. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

afrog批量扫描优化速度脚本

90Sec - 专注于网络空间安全
1 month 3 weeks ago
  1. 背景 小青蛙批量扫站 300多个内网资产 扫了15个小时 扫了35%
  2. 第二天优化 脚本，大概2个小时左右就扫完了35%
    设置5个线程同时跑，单个目标大概需要请求1719次好像是，-rl 默认是150，5个设的各20，设置单个目标扫描超时时间1500s，25分钟还没扫完，就扫下一个。

第一个扫描脚本是：afrog_rce.py

import subprocess import concurrent.futures import os import chardet def read_file_auto_encoding(filename): with open(filename, 'rb') as f: raw = f.read() result = chardet.detect(raw) encoding = result['encoding'] or 'utf-8' try: return raw.decode(encoding) except Exception: return raw.decode('utf-8', errors='replace') def run_afrog(url, idx): out_file = f"result_{idx}.html" command = f"afrog.exe -t {url} -oob dnslogcn -o {out_file} -rl 20 -c 5 -timeout 20 -retries 2 " try: print(f"正在扫描: {url} (任务 {idx + 1})") subprocess.run(command, shell=True, check=True, timeout=1500) print(f"成功扫描: {url}") if os.path.exists(out_file): content = read_file_auto_encoding(out_file) print(f"扫描结果 for {url}:\n{content}\n") else: print(f"提示: {url} 扫描完成但未发现漏洞，未生成结果文件") except subprocess.TimeoutExpired: print(f"错误: {url} 扫描超时未完成。") except subprocess.CalledProcessError as e: print(f"错误发生在 {url}: {e}") except Exception as e: print(f"未知错误发生在 {url}: {e}") def main(): if not os.path.exists('url.txt'): print("错误: url.txt 文件不存在") return with open('url.txt', 'r', encoding='utf-8') as file: urls = [line.strip() for line in file if line.strip()] if not urls: print("错误: url.txt 中没有有效的URL") return total_urls = len(urls) with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor: futures = [] for idx, url in enumerate(urls): futures.append(executor.submit(run_afrog, url, idx)) print(f"已提交任务 {idx + 1}/{total_urls}: {url}") for idx, future in enumerate(concurrent.futures.as_completed(futures)): try: future.result() print(f"任务完成 {idx + 1}/{total_urls}") except Exception as e: print(f"任务处理异常: {e}") def merge_html_files(): all_contents = [] files_merged = 0 for filename in os.listdir('.'): if filename.startswith('result_') and filename.endswith('.html'): try: content = read_file_auto_encoding(filename) all_contents.append(content) files_merged += 1 except Exception as e: print(f"处理文件 {filename} 时出错: {e}") if not all_contents: print("没有找到要合并的结果文件") return with open('jieguo_all.html', 'w', encoding='utf-8') as f: f.write('<!DOCTYPE html>\n<html lang="zh">\n<head>\n<meta charset="UTF-8">\n<title>合并结果</title>\n</head>\n<body>\n') for content in all_contents: f.write('<div>\n') f.write(content) f.write('</div>\n') f.write('</body>\n</html>') print(f"成功合并 {files_merged} 个结果文件到 jieguo_all.html") if __name__ == "__main__": main() merge_html_files() print("已全部完成。")

第2个合并结果脚本是：afrog_jieguo.py

import subprocess import concurrent.futures import os import chardet def read_file_auto_encoding(filename): with open(filename, 'rb') as f: raw = f.read() result = chardet.detect(raw) encoding = result['encoding'] or 'utf-8' try: return raw.decode(encoding) except Exception: return raw.decode('utf-8', errors='replace') def merge_html_files(): all_contents = [] files_merged = 0 for filename in os.listdir('.'): if filename.startswith('result_') and filename.endswith('.html'): try: content = read_file_auto_encoding(filename) all_contents.append(content) os.remove(filename) files_merged += 1 print(f"已合并并删除文件: {filename}") except Exception as e: print(f"处理文件 {filename} 时出错: {e}") if not all_contents: print("没有找到要合并的结果文件") return with open('jieguo_all.html', 'w', encoding='utf-8') as f: f.write('<!DOCTYPE html>\n<html lang="zh">\n<head>\n<meta charset="UTF-8">\n<title>合并结果</title>\n</head>\n<body>\n') for content in all_contents: f.write('<div>\n') f.write(content) f.write('</div>\n') f.write('</body>\n</html>') print(f"成功合并 {files_merged} 个结果文件到 jieguo_all.html") if __name__ == "__main__": merge_html_files()

1 个帖子 - 1 位参与者

阅读完整话题

wione

Iran confirmed it shut down internet to protect the country against cyberattacks

Security Affairs
1 month 3 weeks ago
Iran confirmed an Internet shutdown to counter Israeli cyberattacks, citing threats to critical infrastructure, and interfere with drone control. Iran experienced a near-total internet blackout on Wednesday as tensions with Israel escalated into the first week of conflict. However, the exact cause behind the collapse of Iran’s internet remains unclear. While the timing coincides with […]
Pierluigi Paganini

CVE-2025-6374 | D-Link DIR-619L 2.06B01 /goform/formSetACLFilter curTime stack-based overflow

Vuldb Updates
1 month 3 weeks ago
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. The identification of this vulnerability is CVE-2025-6374. The attack may be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-6375 | poco up to 1.14.1 MultipartReader.cpp MultipartInputStream null pointer dereference (Issue 4915 / EUVD-2025-18796)

Vuldb Updates
1 month 3 weeks ago
A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. This vulnerability is handled as CVE-2025-6375. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-6394 | code-projects Simple Online Hotel Reservation System 1.0 /add_reserve.php firstname sql injection (EUVD-2025-18799)

Vuldb Updates
1 month 3 weeks ago
A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add_reserve.php. The manipulation of the argument firstname leads to sql injection. This vulnerability is known as CVE-2025-6394. The attack can be launched remotely. Furthermore, there is an exploit available. Other parameters might be affected as well.
vuldb.com

Managed ad