CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过Webmin的添加用户功能创建特权用户，然后通过Webmin的运行进程功能获取反弹Shell 测试版本： Webmin 1.973（GitHub最新版本 2021/03/07） 攻击类型： 远程 影响： 远程命令执行 漏洞利用POC代码： YouTube POC： https://youtu.be/qCvEXwyaF5U 产品供应商： https://www.webmin.com 附加信息：...

CVE-2026-67102

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-67102

HCL BigFix Service Management is affected by a Broken Access Control vulnerability that allows a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. The CVSS v3.1 score is 8.1 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CheeseTools

CheeseTools このリポジトリは、既存のMiscToolをベースに作成されています。rasta-mouse氏がツールを公開し、それに取り組む動機を与えてくれたことに大いに感謝します。 CheeseExec PsExecのような機能によるコマンド実行/横移動。特権ユーザーのコンテキストで実行する必要があります。 このツールはrasta-mouseのCsExecをベースにしていますが、サービスの作成において追加の制御を可能にするように設計されています。具体的には: Create サービスが存在するか確認し、存在しなければ作成を試みる Start...

CVE-2024-22120-RCE-with-gopher

使用方法 root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 示例场景 你发现了一个运行在 IP 192.168.1.100 上的 Zabbix 服务器，并且拥有一个低权限用户，其详细信息如下： 会话ID（sid）：d82bf6715e1d3c1f25 主机ID（hostid）：10107 PHP 会话ID（phpsessid）：a4g7f48d9j3r7h8s9g 你希望利用此脚本利用 RCE 漏洞。 运行脚本 root@kitploit: python...

CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

CVE-2025-57520 – Decap CMS（ 复现步骤 1. 以贡献者/编辑者（低权限）身份登录。 2. 创建一篇新的博客文章。 3. 将 payload 插入其中一个易受攻击的字段（例如 title）。 4. 保存该文章。 5. 以管理员（高权限）身份登录。 6. 在预览中打开该文章。 7. Payload 在管理员的浏览器上下文中执行。 截图...

CVE-2026-5173

🦊 CVE-2026-5173：GitLab WebSocket 未授权方法执行 PoC 🛠️ 概述 CVE-2026-5173 允许低权限的已认证攻击者通过 GitLab 的 WebSocket（/-/cable）端点调用受限的后端方法，尤其是通过 。...

CVE-2024-3183-POC

CVE-2024-3183-POC 针对 CVE-2024-3183 的 POC（FreeIPA Rosting） 影响： 低权限用户可以获得所有域用户密码的哈希，并执行离线暴力破解（kerberoasting）。 修补 impacket-getTGT： 1. 将 decoder.decode.defaultErrorState = stGetValueDecoderByTag 添加到 impacket/krb5/kerberosv5.py。 2. 尽情享受吧！ POC1： 1. 将 decoder.decode.defaultErrorState =...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a DBADM privileged user under certain conditions (CVE-2026-87958)

Summary IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a database administration authority DBADM privileged user under certain conditions CVE-2026-87958 Vulnerability Details CVEID:CVE-2026-87958 DESCRIPTION: IBM Db2 11.5.0 through...

CVE-2021-31762

..| CVE-2021-31762 |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过Webmin的添加用户功能创建特权用户，然后通过Webmin的运行进程功能获取反向Shell 测试版本： Webmin 1.973（GitHub最新版本 2021年7月3日） 攻击类型： 远程 影响： 远程命令执行 利用代码POC： YouTube POC： https://youtu.be/qCvEXwyaF5U 产品供应商： https://www.webmin.com 附加信息：...

EUVD-2026-79217

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

EUVD-2026-79197

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise...

CVE-2026-90971

CVE-2026-90971 is a Server-Side Request Forgery (SSRF) vulnerability in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier . A low-privileged authenticated user can submit a crafted connection definition for datacenter discovery, enabling them to obtain other users' cr...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

EUVD-2026-78138

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

CVE-2026-7884 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

CVE-2026-34213

CVE-2026-34213 Un usuario de Docmost con pocos privilegios podría proporcionar un attachmentId de una víctima al endpoint de carga genérico y sobrescribir el archivo adjunto de otra página dentro del mismo espacio de trabajo. Introducción Identifiqué, divulgué responsablemente y reproduje una fal...

CVE-2026-77147

CVE-2026-77147 is a code injection vulnerability in Apache Syncope 's Groovy security sandbox. An administrator with sufficient entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in the CommandArgs static implementation , bypassing the sandbox —...