CVE-2026-95811

A flaw was found in lemonldap-ng. The request handler evaluates security rules against raw, unnormalized web addresses while the underlying web server processes decoded and normalized paths. An authenticated attacker can exploit this discrepancy by submitting specially crafted requests containing...

CVE-2026-92289

A flaw was found in lemonldap-ng. When configured to accept either client secrets or Proof Key for Code Exchange PKCE, a security mechanism designed to protect authorization codes, the portal fails to validate client credentials properly for public clients. A remote attacker who intercepts an...

CVE-2026-92288

A flaw was found in lemonldap-ng. The OAuth 2.0 Open Authorization token introspection endpoint fails to properly verify client credentials when handling requests for public relying parties. A remote attacker possessing an access token and a public client identifier can exploit this vulnerability...

CVE-2026-97721 Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData...

CVE-2026-97721 Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData...

kj33-cpe-root-shell

One POST to root: the "Wi-Fi 6" 5G CPE that isn't A carrier...

cve

cve Vulnerability advisories reported by SDshadow, format...

Security Bulletin: IBM Verify Identity Governance Container affected by multiple vulnerabilities

Summary Multiple security vulnerabilities affecting dependent components used by IBM Verify Identity Governance Container have been addressed in the latest product update. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily...

CVE-2026-97818

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-97737

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

The tracing method of this honeypot targets red team members using mobile hotspots. The honeypot directly obtains the attacker's phone number for tracing. It catches them every time. Red team members, be careful. First, when you open the website, it monitors whether the F12 console is opened. If...

CVE-2022-44877-white-box

Docs Paper : https://docs.google.com/document/d/1rQ7e9i2AFzHbASfRu3nkgjIswbrS2AB2i7V9OK3dJLs/edit?usp=sharing Libprochider : https://github.com/gianlucaborello/libprocesshider /var/www/html YouTube Demo : https://www.youtube.com/watch?v=V0HgzE8IElA&t=343s tested machine box CentOS 7 - CentOS Web...

GenEtherExploit

EN GenEtherExploit is a Proof-of-Concept PoC exploit for the macOS vulnerability CVE-2023-40404. This PoC leverages IOKit APIs to interact with the IOUserEthernetResource network service, manipulating the system's network interfaces. The purpose of this exploit is to demonstrate a potential kerne...

Samuraizer

Samuraizer — Cyber‑Security Knowledge Base Engine NotebookLM on steroids — purpose-built for security researchers. 💡 Why Samuraizer? Every security researcher knows the feeling — you find an interesting GitHub repo, a fresh CVE writeup, a blog post about a new exploitation technique. You forward ...

GyoiThon

GyoiThon : Next generation penetration test tool Japanese page is here. Presentation January 25th,2018:JANOG41 March 23th,2018:Black Hat ASIA 2018 Arsenal August 12th,2018:DEFCON26 DemoLabs October 24th,2018:OWS in CSS2018 November 3rd,2018:AV TOKYO 2018 HIVE December 22-23th,2018:SECCON YOROZU...

POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the same POC, just change the provider param. Note Sometimes the nc file can't execute on the server or can't execute command! Install require root@kitploit: pip install requests Run Exploit root@kitploit: python3 POCCVE-2024-46256.py + Targe...

CVE-2022-1292

CVE-2022-1292 POC Description root@kitploit: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: root@kitploit:...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell This script demonstrates how to exploit CVE-2024-32002 to obtain a reverse shell, providing remote access to the affected system. Use it with caution in controlled environments and only for educational or security testing purposes. Blog Post This script is inspired by...