129896 matches found
CVE-2023-40931-PoC
CVE-2023-40931 Il payload sqlmap per sfruttare la CVE-2023-40931 Payload Informazioni richieste: Nome utente e password validi Dominio e percorso dell'istanza ospitata root@kitploit: sqlmap -D nagiosxi -T xiusers -u...
CVE-2025-20029-simulation
🔐 Simulazione di Attacco Ripetibile – CVE-2025-20029 ⚠️ Questo repository simula CVE-2025-20029 in un ambiente sicuro e controllato. Non interagisce con sistemi F5 BIG-IP reali né sfrutta alcun servizio di produzione. L'obiettivo è educativo: studiare il pattern della vulnerabilità e testare i...
CVE-2025-66837
CVE-2025-66837 Schädlicher Datei-Upload Beschreibung Eine Datei-Upload-Sicherheitslücke in ARIS ermöglicht es Angreifern, beliebigen Code auszuführen, indem sie eine manipulierte PDF-Datei/Malware hochladen CVSS-Score: 6.8 Mittel Angriffstyp Remote authentifiziert Betroffene Versionen Versionen v...
CVE-2024-21689
CVE-2024–21689 RCE Bamboo Data Center e Server Atlassian Punteggio CVSS - 7.6 🔥 Descrizione Questa vulnerabilità RCE Remote Code Execution ad alta gravità, CVE-2024-21689, è stata introdotta nelle versioni 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 e 9.6.0 di Bamboo Data Center e Server. Questa...
CVE-2023-31702
CVE-2023-31702 — Iniezione SQL nella eScan Management Console Autenticata Panoramica CVE-2023-31702 è una vulnerabilità di iniezione SQL autenticata scoperta in MicroWorld Technologies eScan Management Console versione 14.0.1400.2281. La vulnerabilità è presente nell'endpoint GetUserCurrentPwd,...
CVE-2024-57785
CVE-2024-57785 root@kitploit: Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional...
CVE-2024-57784
CVE-2024-57784 root@kitploit: Exploit Title: Authenticated Directory Traversal Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57784 usage: CVE-2024-57784.py -h -u URL -f FILE optional...
CVE-2025-68613
CVE-2025-68613 n8n è una piattaforma open source per l'automazione dei flussi di lavoro. Le versioni a partire da 0.211.0 e precedenti a 1.120.4, 1.121.1 e 1.122.0 contengono una vulnerabilità critica di esecuzione di codice in remoto RCE nel sistema di valutazione delle espressioni dei flussi di...
CVE-2026-76060
An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2024-9264
CVE-2024-9264 root@kitploit: python CVE-2024-9264.py '' -u '' -p '' -c ''...
CVE-2026-81931
Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...
CVE-2026-53580
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...
CVE-2026-54721
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2022-36779
Iniezione di comandi autenticata per CVE-2022-36779 divertiti :...
cve-2021-3164
Church Rota versione 2.6.4 è vulnerabile all'esecuzione remota di codice autenticata. L'utente non necessita di avere il permesso di caricamento file per caricare ed eseguire un file arbitrario. Dopo aver effettuato l'accesso a Church Rota, invia la seguente richiesta, sostituendo con il tuo...
EUVD-2026-67229
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...
CVE-2024-25641-Exploit-for-Cacti-1.2.26
CVE-2024-25641 Exploit per Cacti 1.2.26 Sfruttamento di CVE-2024-25641 su Cacti 1.2.26. Quando un utente è autenticato, una vulnerabilità di scrittura arbitraria di file consente l'esecuzione remota di codice RCE. Panoramica Questo script automatizza il processo di sfruttamento di CVE-2024-25641 ...