CVE-2023-23397-PoW

CVE-2023-23397-PoW Proof of Work of CVE-2023-23397 for vulnerable Microsoft Outlook client application. For educational and research puproses only. CVE-2023-23397 preview This CVE aimed to retrieve NetNTLM hash logged in user from Microsoft Outlook client version 2016 except last patched version...

challenges

Hex Advent CTF 欢迎参加 HEX ADVENT 2025，又到了释放你潜力的时节！🎁 HEX ADVENT 2025 是一个以圣诞节为主题的 CTF 降临节日历，由女性设计，专为女性打造。 12 天，12 项挑战：以结构化的安排，助你在不同 CTF 类别中掌握技能。 重点领域 root@kitploit: - Pwn（二进制利用） - 密码学 - 逆向工程 - 取证 - OSINT - Web 漏洞利用 我们的使命 赋能网络安全领域的女性，树立可见的榜样，并培养一支强大的本地人才队伍。 挑战 1. Christmas Wishlist 🎄 Web 2. Merry...

CVE-2023-35636

CVE-2023-35636 Microsoft Outlook Information Disclosure Vulnerability leak password hash - Expect Script POC CVE-2023-35636 an exploit of the calendar sharing function in Microsoft Outlook, whereby adding two headers to an email directs Outlook to share content and contact a designated machine...

ics-phishing-toolkit

ics-phishing-toolkit This toolkit for remediating malicious calendar invites is designed to help teams using email security solutions that don't natively remediate these attacks. If you're using Sublime, you don't need this toolkit because remediation is natively supported. Supported stacks...

CVE-2026-49772

The Events Calendar SQL Injection CVE-2026-49772 PoC Description CVE-2026-49772 is an unauthenticated blind SQL injection in the WordPress plugin The Events Calendar. A broken REST parameter validator validatecallback returns a closure instead of validating lets the order parameter on the...

CVE-2023-23397-POC-Powershell

CVE-2023-23397-POC-Powershell 脚本函数，用于通过 ReminderSoundFile 选项发送或保存日历 NTLM 泄露。 运行脚本以在 Powershell 中加载函数，然后可以使用下面的示例作为使用函数的起点。 需要在安装了 Outlook 的 Windows 机器上运行，因为它使用 Outlook COM 对象发送电子邮件。 注意，它将从 Outlook 关联的电子邮件账户发送。当前函数会将会议开始时间设置为脚本执行时，持续 2 小时。 发送： root@kitploit: Send-CalendarNTLMLeak -recipient...

CVE-2021-24145

CVE-2021-24145 WordPress文件上传漏洞，Modern Events Calendar Lite WordPress插件5.16.5之前版本 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 安装与运行顺序 1. WordPress安装 进行安装时，请从docker-compose.yml文件中进行端口转发。 root@kitploit: $ docker-compose up 2. WordPress初始化及插件安装 前往 http://web服务器ip:端口/ 进行基本安装。 前往 插件 - 添加新 - 上传插件。...

WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...

CVE-2026-84745

The Events Calendar WordPress plugin (before 6.17.3.1 ) fails to restrict non-public event, venue, and organizer content in its public REST archives. As a result, any authenticated user with a Contributor or higher role can read the full contents of every unpublished record on the site, including...

EUVD-2026-71864

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

WordPress Spider Calendar <=1.4.9 - SQL Injection

WordPress Spider Calendar plugin through 1.4.9 is susceptible to SQL injection. An attacker can execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php, thus making it possible to obtain sensitive information, modify data, and/or execut...

Webnus Inc. Modern Events Calendar - Broken Access Control

Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. id: CVE-2026-32583 info: name: Webnus Inc. Modern Events...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress My Calendar <= 3.1.9 - Cross-Site Scripting

WordPress plugin My Calendar = 3.1.10 or apply the vendor-provided patch to fix the XSS vulnerability. reference: - https://wpscan.com/vulnerability/9267 - https://wordpress.org/plugins/my-calendar/developers - https://nvd.nist.gov/vuln/detail/CVE-2019-15713 -...

WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...