269469 matches found
CVE-2026-89243
WWBN AVideo (through commit c3edcc27) contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name(), which fails to sanitize the group_name input. An administrator holding the canAdminUserGroups permission can inject malicious HTML or JavaScript that executes in the browser ...
CVE-2025-58434-59528-htb-ctf
CVE-2025-58434-59528-htb-ctf Silentium 利用链 本仓库包含针对 Hack The Box 中 Silentium 机器的完整利用链。该漏洞利用分两个阶段：用户枚举和 JavaScript 注入，以实现 远程代码执行（RCE） 。 📝 描述 该漏洞链包含一个信息泄露缺陷和一个关键代码注入。首先通过密码重置漏洞枚举有效用户，从而获得攻击 customMCP 端点所需的上下文信息。RCE 是通过将恶意 JavaScript 函数注入到 mcpServerConfig 参数中实现的，该函数由 Node.js 后端执行。 🛠️ 功能 用户枚举...
CVE-2026-11961
CVE-2026-11961 针对影响 WordPress User Registration & Membership 插件的 CVE-2026-11961 的大规模利用工具。 功能 插件版本检测 单目标支持 批量目标处理 多线程支持 随机或自定义凭据 HTTP/HTTPS 代理支持 请求超时配置 JSONL 输出 日志文件支持 Telegram 通知 强制模式 --force 用法 root@kitploit: Show help python3 mass.py -h Single target python3 mass.py -u https://target.com Single...
CVE-2023-38831
CVE-2023-38831 Una demostración de prueba de concepto de CVE-2023-38831 Breve descripción de la vulnerabilidad CVE-2023-38831 es una vulnerabilidad de software. El software explotado es WinRAR, que es ampliamente utilizado por casi todo el mundo. Es un software que ayuda a comprimir diferentes...
CVE-2024-49328-exploit
CVE-2024-49328-exploit 🌟 描述： 此脚本利用了 WordPress 的 WP REST API FNS 插件中的权限提升漏洞。该漏洞影响 1.0.0 及之前的所有版本，允许未经身份验证的攻击者获取管理员权限。 ⚙️ 用法 root@kitploit: options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site -e NEWEMAIL, --Newemail NEWEMAIL New email to register -p...
MYSQL-UDF-Exploit
MYSQL-UDF-Exploit MYSQL UDF 漏洞利用...
CVE-2026-80469
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...
CS-Remote-OPs-BOF
远程操作 BOF 本仓库是我们先前发布的 SA 仓库的补充。我们最初的立场是不发布用于修改其他系统的工具，而只以开箱即用的格式提供信息收集工具。 随着时间的推移，我们看到许多其他公开安全公司发布了面向攻击性的工具，我们现在认为发布一部分我们的攻击性工具是合适的。 这个仓库中没有什么特别之处，都是以 BOF 形式实现的基础 Microsoft Windows 操作。这些原语可用于各种操作。 注入 BOF 我们决定包含在进行 EDR 检测测试时使用的注入 BOF。这些 BOF 按原样提供，且不会得到支持（src/Injection 和 Injection/ 下的所有内容）。 欢迎你使用这些...
linux-malware-detect
Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...
CVE-2026-80469
CVE-2026-80469 affects the Device Manager extension shipped with SICK Sentio Creator , in releases up to and including version 2026.2 . An attacker can achieve arbitrary code execution on a target system by uploading a malicious device driver package that bypasses driver verification mechanisms, ...
EUVD-2026-76022
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...
directus-security
directus-security 审计任何 Directus 实例中真正会泄露数据的错误配置——公共角色读取暴露、用户枚举、未认证的版本/模式泄露、GraphQL 内省，以及 search 参数字段枚举预言机——并通过匿名探测 逐项实况验证。其他清单只会告诉你哪里 可能 有问题；本工具会拉取实际数据，展示真实存在的问题。 ⚡ 一行命令即可运行，无需管理员令牌，无需安装： root@kitploit: npx directus-security --url https://your-directus.example.com 🤝 想让我们代劳？ 固定范围审计 — $99 / 24...
CVE-2026-89173
The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...
EUVD-2026-76000
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...
CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...
CVE-2026-14566
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...
CVE-2026-73784
A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user...
CVE-2024-51996
⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit 针对关键漏洞 CVE-2024-51996 的 Exploit，可在使用 Remember Me 机制的 Symfony 应用中实现 认证绕过 。 🧠 影响 ：无需有效凭据即可冒充特权用户（如 admin）。 📖 描述 CVE-2024-51996 是 Symfony 组件 security-http 中的一个漏洞。问题在于 未能正确验证REMEMBERME cookie 中所包含的用户名，从而允许在令牌未失效的情况下修改用户名。 拥有有效 cookie（例如...