gmh5225

30 exploits Active since Jun 2003
CVE-2022-44721 NOMISEC WORKING POC
Rejected
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2841. Reason: This issue was MERGED into CVE-2022-2841 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2022-2841 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
23 stars
CVE-2022-35737 NOMISEC HIGH WORKING POC
SQLite 1.0.12-3.39.x - Array Index Overflow via String Argument to C API
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
12 stars
CVSS 7.5
CVE-2015-2291 NOMISEC HIGH WORKING POC
Intel Ethernet Diagnostics Driver IQVW32.sys and IQVW64.sys < 1.3.1.0 - Denial of Service via IOCTL Call
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
4 stars
CVSS 7.8
CVE-2025-6554 NOMISEC HIGH STUB
Google Chrome < 138.0.7204.96 - Type Confusion in V8
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
2 stars
CVSS 8.1
CVE-2024-4956 NOMISEC HIGH WORKING POC
Sonatype Nexus Repository <3.68.1 - Path Traversal
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.
2 stars
CVSS 7.5
CVE-2020-36603 NOMISEC MEDIUM WRITEUP
Genshin Impact <1.0.0.0 - Code Injection
The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.
2 stars
CVSS 6.5
CVE-2025-6558 NOMISEC HIGH WRITEUP
Google Chrome <138.0.7204.157 - RCE
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
1 stars
CVSS 8.8
CVE-2023-21739 NOMISEC HIGH WRITEUP
Windows Bluetooth Driver - Privilege Escalation
Windows Bluetooth Driver Elevation of Privilege Vulnerability
1 stars
CVSS 7.0
CVE-2022-41114 NOMISEC HIGH WRITEUP
Windows Bind Filter Driver - Privilege Escalation
Windows Bind Filter Driver Elevation of Privilege Vulnerability
1 stars
CVSS 7.0
CVE-2025-24893 NOMISEC CRITICAL WORKING POC
XWiki Platform - Remote Code Execution
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
CVSS 9.8
CVE-2025-53770 NOMISEC CRITICAL SCANNER
Microsoft SharePoint Server - Code Injection
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
CVSS 9.8
CVE-2022-24716 NOMISEC HIGH WORKING POC
Icinga Web 2 <2.9.5 - Info Disclosure
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
CVSS 7.5
CVE-2025-48799 NOMISEC HIGH WORKING POC
Windows Update Service - Privilege Escalation
Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8
CVE-2025-6554 NOMISEC HIGH WORKING POC
Google Chrome < 138.0.7204.96 - Type Confusion in V8
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS 8.1
CVE-2025-54574 NOMISEC CRITICAL WRITEUP
Squid < 6.4 - Heap-based Buffer Overflow via URN Processing
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
CVSS 9.3
CVE-2025-31131 NOMISEC HIGH WORKING POC
Yeswiki < 4.5.2 - Unauthenticated Path Traversal
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
CVSS 8.6
CVE-2025-4322 NOMISEC CRITICAL SCANNER
Motors WordPress <5.6.67 - Privilege Escalation
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
CVSS 9.8
CVE-2025-1562 NOMISEC CRITICAL WORKING POC
FunnelKit Automations < 3.5.3 - Unauthenticated Arbitrary Plugin Installation via install_or_activate_addon_plugins
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
CVSS 9.8
CVE-2025-22963 NOMISEC HIGH WRITEUP
Teedy <= 1.11 - Cross-Site Request Forgery via POST /api/user/admin
Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
CVSS 7.5
CVE-2025-32463 NOMISEC CRITICAL WORKING POC
Sudo <1.9.17p1 - Privilege Escalation
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVSS 9.3
CVE-2024-6028 NOMISEC CRITICAL WORKING POC
Quiz Maker < 6.5.8.3 - Unauthenticated Time-Based SQL Injection via ays_questions Parameter
The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS 9.8
CVE-2025-0282 NOMISEC CRITICAL WORKING POC
Ivanti Connect Secure <22.7R2.5 - RCE
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS 9.0
CVE-2024-4577 NOMISEC CRITICAL SCANNER
PHP CGI Argument Injection Remote Code Execution
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS 9.8
CVE-2023-47253 NOMISEC CRITICAL WRITEUP
Qualitor < 8.20 - Remote Code Execution via processVariavel.php gridValoresPopHidden Parameter
Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
CVSS 9.8
CVE-2023-4220 NOMISEC HIGH WORKING POC
Chamilo v1.11.24 Unrestricted File Upload PHP Webshell
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
CVSS 8.1