CVE-2026-5173

🦊 CVE-2026-5173: Prova de Conceito de Execução Não Autorizada de Método via WebSocket do GitLab 🛠️ Visão Geral CVE-2026-5173 permite que um atacante autenticado com privilégios baixos chame métodos restritos do backend por meio do endpoint WebSocket /-/cable do GitLab, especificamente via...

CVE-2021-32160

..| XSS zu privilegiertem Benutzer |.. Beschreibung : Ausnutzung eines Reflected Cross-Site Scripting XSS-Angriffs, um über die Webmin-Funktion zum Hinzufügen von Benutzern einen privilegierten Benutzer zu erstellen und dann über die Webmin-Funktion für laufende Prozesse eine Reverse Shell zu...

CVE-2021-31762

..| CVE-2021-31762 |.. Descrizione : Sfruttamento di un attacco Cross-site request forgery CSRF per creare un utente privilegiato tramite la funzione di aggiunta utenti di Webmin e successivamente ottenere una reverse shell tramite la funzione dei processi in esecuzione di Webmin Versione Testata...

CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

CVE-2024-3183-POC

CVE-2024-3183-POC CVE-2024-3183 FreeIPA Rosting के लिए POC प्रभाव: एक निम्न-विशेषाधिकार प्राप्त उपयोगकर्ता सभी डोमेन उपयोगकर्ताओं के पासवर्ड का हैश प्राप्त कर सकता है और ऑफ़लाइन ब्रूट फोर्स kerberoasting कर सकता है। impacket-getTGT पैच करें: 1. impacket/krb5/kerberosv5.py में...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Descrizione : Sfruttando un attacco Cross-site request forgery CSRF per creare un utente privilegiato attraverso la funzionalità di aggiunta utenti di Webmin, ottenendo poi una reverse shell tramite la funzionalità di processo in esecuzione di Webmin Versione...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

CheeseTools

CheeseTools Dieses Repository basiert auf dem bereits existierenden MiscTool, daher ein großes Lob an rasta-mouse für die Veröffentlichung und dafür, dass er mir die richtige Motivation gegeben hat, daran zu arbeiten. CheeseExec Befehlsausführung / Seitwärtsbewegung über PsExec-ähnliche...

CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

CVE-2025-57520 – XSS persistente in Decap CMS Passaggi 1. Accedi come Contributor/Editor privilegio basso. 2. Crea una nuova voce del blog. 3. Inserisci il payload in uno dei campi vulnerabili es. titolo. 4. Salva la voce. 5. Accedi come Admin privilegio elevato. 6. Apri la voce in Anteprima. 7. ...

CVE-2024-22120-RCE-with-gopher

Utilizzo root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Scenario di Esempio Hai identificato un server Zabbix in esecuzione sull'IP 192.168.1.100 e hai accesso a un utente con privilegi limitati con i seguenti dettagli: ID sessione sid: d82bf6715e1d3c1f25 ...

CVE-2026-81625

CVE-2026-81625 is a stack buffer overflow in Greenbone OS and openvas-scanner . A remote attacker with user privileges can execute a malicious or compromised NASL vulnerability test (VT) to trigger the overflow, potentially gaining full access to the system. The vulnerability is rated HIGH with a...

CVE-2026-81625 Stack buffer overflow in Greenbone OS and openvas-scanner

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...

EUVD-2026-66771

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

EUVD-2026-66765

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account...

CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

EUVD-2026-66332

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...

CVE-2026-78237

Admin By Request (ABR) for macOS is affected by an insufficient input validation flaw (CVE-2026-78237, CVSS 7.8 HIGH ). A low-privileged local user can inject malicious entries into the sudoers file during an ABR session, granting persistent root access that remains effective even after the eleva...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

EUVD-2026-65339

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137

CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...