Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Xibo CMS Zip Slip RCE Exploit CVE-2023-33177 This exploit demonstrates a path traversal vulnerability in Xibo CMS CVE-2023-33177 that allows remote code execution through malicious layout imports. Vulnerability Details CVE/Advisory: CVE-2023-33177 Affected Versions: Xibo CMS 1.8.0 - 2.3.16 Xibo C...

packer-tutorial

Table of Contents 1. What is a packer? : An introduction into the purpose of packers and a guide through what the development necessities of a packer are. 2. Prerequisites : Tools needed to work with this tutorial. 3. Getting a taste : A demonstration of what you will be building with this...

Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Ejecútalo directamente root@kitploit: python server-1.py Carga arbitraria de archivos root@kitploit: PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 El resultado es el siguiente: CVE-2021-41127 server-1.py El...

CVE-2022-2185

CVE-2022-2185 wo ee cve-2022-2185 gitlab authenticated rce read: https://starlabs.sg/blog/2022/07-gitlab-project-import-rce-analysis-cve-2022-2185/ how to use First spawn a gitlab instance. Log in, create a group and project with a unique name. Create an access token. Edit these lines in main.go...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-49469 GLPI: LDAP filter injection in user import feature

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...

CVE-2026-49469

The asset and IT management software GLPI is vulnerable to an LDAP filter injection in the user import feature. In versions 0.70 through 10.0.26 and 11.0.8 , an authenticated hotliner or technician can submit crafted criteria to bypass the configured default LDAP filter. This allows the attacker ...

CVE-2026-56725 Zammad: Denial of Service via OTRS Import Controller

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/importcheck blocks a Zammad request worker for roughly two minutes. The importcheck and importstatus actions are missing the setupdoneresponse guard...

CVE-2026-85542

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

CVE-2026-85542

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability within the GIM bundle import functionality . An authenticated attacker can supply a maliciously crafted GIM bundle, causing the system to pass attacker-controlled arguments to the tar command . This flaw can lead t...

CVE-2026-85542 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

EUVD-2026-87097

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

CVE-2026-100190 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

CVE-2026-100190 Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

CVE-2026-3629

CVE-2026-3629 - Comprobador de Escalada de Privilegios en WordPress Una herramienta de línea de comandos para detectar CVE-2026-3629 , una vulnerabilidad crítica de escalada de privilegios en el plugin de WordPress "Import and export users and customers". 📢 Únete a Nuestra Comunidad ¡Mantente al...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

CVE-2026-22241

🚨 CVE-2026-22241 - Open eClass Theme Import Remote Code Execution 📌 Vulnerability Summary Open eClass also known as GUnet eClass, a widely used open-source Learning Management System LMS, contains a critical Unrestricted File Upload vulnerability in its Theme Import feature. An authenticated...

DRMBinViaOrdinalImports

DRMBinViaOrdinalImports - Create Anti-Copy DRM Malware Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing Summary This repository uses a technique to modify a program's Import Address Table IAT by replacing the imported function names with their corresponding ordinals,...

dll-proxy-generator

DLL Proxy Generator Generate a proxy dll for arbitrary dll, while also loading a user-defined secondary dll. Usage dll-proxy-generator.exe OPTIONS --import-dll --import Arguments Path to dll to proxy Options root@kitploit: -d, --import-dll Extra dll to import -i, --import Import name or ordinal -...

GitLab CE/EE - Remote Code Execution

GitLab CE/EE 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 is susceptible to remote code execution. An authenticated user authorized to import projects can import a maliciously crafted project, thus possibly being able to execute malware, obtain sensitive information, modi...