CVE-2026-86683

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86678

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

crackerjack

!CAUTION 此仓库不再维护，请访问 https://github.com/sadreck/crackerjack 获取最新版本。 CrackerJack 由 Context Information Security 开发的 Hashcat 网页界面 目录 介绍 架构 功能特点 局限性 安装 故障排除 截图 许可证 介绍 CrackerJack 是一个用 Python 开发的 Hashcat 网页图形界面。 架构 本项目旨在保持 GUI 与 Hashcat 独立。简要来说，工作原理如下： 用户上传哈希值，选择字典/规则/掩码等，然后点击“开始”。 Web 服务器生成一个新的 scre...

CVE-2026-62998

The REDAXO PHP-based content management system is vulnerable to an unauthorized ORDER BY identifier injection in versions prior to 5.21.2 . The root cause is located in rex_list::getSortColumn() within redaxo/src/core/lib/list.php, which fails to verify if a requested column was registered via se...

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

githubFind3r

githubFind3r githubFind3r 是一个高速的命令行仓库/用户/提交搜索工具 动图演示 安装 root@kitploit: git clone https://github.com/atmoner/githubFind3r.git cd githubFind3r npm install 运行 root@kitploit: node githubFind3r.js...

CVE-2023-32315-POC

CVE-2023-32315-POC CVE-2023-32315-Openfire-Bypass-Py 概述 这个代码是CVE-2023-32315 Python版本的POC，用于执行一系列操作来验证目标网站是否受 CVE-2023-32315 漏洞的影响，并尝试在受影响的网站上执行一些操作。 经过验证，cookie的csrf和jsessionid并非必要，只要有而且格式正确就行，4.0.x左右的低版本没用csrf...

CVE-2020-25627

CVE-2020-25627 Stored XSS via moodlenetprofile parameter in user profile My PoC about this CVE User requirement: Student Or the site for registeration XSS in moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user without assigning rol...

CVE-2024-37081

CVE-2024-37081: Múltiples escaladas de privilegios locales en VMware vCenter Server El servidor vCenter contiene múltiples vulnerabilidades de escalada de privilegios locales debidas a una mala configuración de sudo. Un usuario local autenticado con privilegios no administrativos podría explotar...

CVE-2016-2098

CVE-2016-2098 当在用户提供的数据上使用 render 时，Ruby-on-Rails 中的远程代码执行漏洞。 说明： 此问题源于对用户提供的数据使用 render 方法。 render 方法通常用于从模板渲染页面，但 render 方法也允许开发者渲染纯文本（plaintext）甚至内联代码（inline）。 render 函数： root@kitploit: File actionpack/lib/abstractcontroller/rendering.rb, line 23 def renderargs, &block options =...

CVE-2016-6210-Exploit

Esta es la primera versión del exploit "armado" para CVE-2016-6210 Antecedentes: Publicado por Eddie Harari en Full Disclosure http://seclists.org/fulldisclosure/2016/Jul/51 Resumen breve: Al enviar contraseñas grandes, un usuario remoto puede enumerar usuarios en un sistema que ejecuta SSHD. Est...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install root@kitploit: GO111MODULE=on go install...

CVE-2026-86678

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

CVE-2026-86678 Broken Authentication vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

EUVD-2026-85295

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

CVE-2026-86677

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

EUVD-2026-85293

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

TelemetrySourcerer

Telemetry Sourcerer 简介 Telemetry Sourcerer 可以枚举并禁用 Windows 上 AV/EDR 常用的遥测来源。 红队人员和安全爱好者可以在实验环境中使用此工具来： 识别目标产品基于收集的盲点。 确定哪些遥测来源生成特定类型的事件。 验证使用该工具的篡改功能是否会导致检测。 有关构建私有实验环境的详细信息，请参阅我关于 将 EDR 遥测转向私有基础设施 的文章。 OPSEC 警告 ：虽然可以在目标环境中使用此工具，但直接使用任何进攻性安全工具都存在 OPSEC 风险。建议将本项目的代码集成到您自己的工具中，并结合其他技术来减少其产生的痕迹。 功能...