socks5

socks5 Socks5/Socks5h 服务器和客户端 该项目是为 Bridge 添加协议支持，也可单独使用 用法 API 文档 示例 支持 CONNECT 命令 支持 BIND 命令 支持 ASSOCIATE 命令 许可证 根据 MIT 许可证授权。完整的许可证文本请参见 LICENSE。...

OnionHop

OnionHop V3 OnionHop V3 是一款现代化的跨平台 桌面应用（支持 Windows、macOS 和 Linux），它能够通过 Tor 路由你的网络流量。它可以作为本地 SOCKS 代理或系统级隧道运行 Tor，通过 Smart Connect 自动为你的网络选择可行的连接策略，扫描并应用适用于受限网络的各类传输协议的桥梁，甚至允许你志愿成为 Snowflake 代理。 免责声明 OnionHop 按“原样”提供。在某些地区，使用 Tor 可能是违法或受限制的。你需自行遵守当地法律法规。 V3 的新特性（自 v2.7 以来） V3 是在全新跨平台 UI...

CVE-2023-43208-PoC

CVE-2023-43208 - Ejecución Remota de Código RCE no autenticada en Mirth Connect Requisitos Python 3.11 o superior probado en 3.11, 3.12, 3.13 Configuración root@kitploit: Create a clean virtual environment python3 -m venv .venv source .venv/bin/activate Install pinned dependencies pip install -r...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

RStudio Connect - Open Redirect

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. id: CVE-2022-38131 info: name: RStudio Connect - Open Redirect author: xxcdd severity: medium description: | RStudio Connect prior to...

iSpy 7.2.2.0 - Authentication Bypass

iSpy 7.2.2.0 contains an authentication bypass vulnerability. An attacker can craft a URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-29775 info: name: iSpy 7.2.2.0 - Authentication Bypass author: arafatansari severity: critical...

SmarterMail - Remote Code Execution

SmarterTools SmarterMail build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication. id: CVE-2026-24423 info: name: SmarterMail - Remote...

InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

MCPJam Inspector - Remote Code Execution

MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. id:...

Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)

Pulse Secure Pulse Connect Secure PCS 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit ...

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

CVE-2024-2667

InstaWP Connect – 一键WP暂存与迁移 您可以使用任何有效或无效的API密钥。 overridepluginzip - 包含带有后门的恶意WordPress插件的zip文件路径。 导入后，您可以通过 http://victim-domain/wp-content/plugins/malicious-plugin/backdoor.php 访问后门（假设目录名为malicious-plugin且backdoor.php位于该目录下）。 参考文献：...

ADSyncDump-BOF

ADSyncDump BOF El ADSyncDump BOF es un port del adconnectdump.py / ADSyncDecrypt de Dirkjan Mollema a un archivo de objeto Beacon BOF para usarlo con Cobalt Strike, Sliver y Havoc. !NOTE La herramienta ha sido probada en Windows Server 2019 con Azure AD Connect versión 2.2.1.0. La versión de 32...

bbs

BBS El antiguo bbs se puede encontrar aquí Descripción bbs es un enrutador para proxies SOCKS y HTTP. Expone servicios SOCKS5, HTTP CONNECT o redirección de puertos y reenvía las peticiones entrantes a proxies o cadenas de proxies según el destino de la petición. El enrutamiento se puede configur...

CVE-2020-9442

Título del Exploit: OpenVPN Connect para Windows MSI - 3.1.0.361 - Escalada de Privilegios Fecha: 2020-02-28 Autor: Andrew Hess Enlace del software: https://openvpn.net/client-connect-vpn-for-windows/ Versión: 3.1.0.361 MSI CVE: CVE-2020-9442 Historial 2019.12.15 - Vulnerabilidad descubierta...

dex

dex - Un proveedor OpenID Connect federado Dex es un servicio de identidad que utiliza OpenID Connect para impulsar la autenticación de otras aplicaciones. Dex actúa como un portal hacia otros proveedores de identidad a través de "conectores". Esto permite que dex delegue la autenticación en...

CVE-2025-0282

PoC para CVE-2025-0282 Desbordamiento de búfer de pila remoto no autenticado en productos Ivanti Resumen Esta prueba de concepto demuestra la explotación de CVE-2025-0282, una vulnerabilidad crítica que afecta a: Ivanti Connect Secure Ivanti Policy Secure Ivanti Neurons for ZTA gateways Basado en...