CVE-2025-8714-POC

CVE-2025-8714-POC PostgreSQLにおけるRCEのPoC — CVE-2025-8714 PostgreSQLにおけるリモートコード実行のPoC — CVE-2025-8714 pgdump リバースシェル このリポジトリは、CVE-2025-8714 の深刻な脆弱性に対する概念実証（PoC）を提示します。この脆弱性は、以下のPostgreSQLバージョン以前に影響します: 17.6, 16.10, 15.14, 14.19, 13.22, および18 Beta ...。この脆弱性により、送信元サーバーでスーパーユーザー権限を持つ攻撃者が、pgdump または...

CVE-2024-29510

原始研究及POC代码：https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ 注意：除执行的命令外，我未对POC做任何修改。全部功劳归功于 Codean Labs 的 Thomas Rinsma 的出色研究及POC。 本地场景 1. 封装在stager脚本中，用于下载并运行检查脚本以判断主机是否存在漏洞 2. 修改POC以下载并执行Python3反弹Shell 3. Stager和反弹Shell通过标准输入下载并执行 4. POC会在 /tmp...

OESA-2026-3878 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

parquet-avro-rce

このリポジトリには README がありません。...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

Risk-Analysis-Editor

Risk Analysis Editor RAE English · Français Standalone tool for building and visualizing risk matrices — inherent gross risk and residual net risk — with an open, documented file format, .rae.json. ▶️ Open the app · 📖 User guide · 🎬 Video tutorials · ⬇️ Download No installation: the tool runs...

ticket_converter

このスクリプトはもはやサポートされていません 代わりに impacket のサンプル ticketConverter.py を使用してください。 ticketconverter ccache チケットを kirbi KRB-CRED に、またその逆に変換する、impacket ベースの小さなツールです。 入力として ccache または kirbi ファイルを指定する必要があります。スクリプトは形式を検出して変換します。 インストール root@kitploit: git clone https://github.com/Zer1t0/ticketconverter cd...

vuln-list-backup

vuln-list 脆弱性情報を収集し、解析可能な形式で自動的に保存します ソース ディレクトリ| OS| ソース| URL ---|---|---|--- alma/| AlmaLinux| AlmaLinux Errata| https://errata.almalinux.org/8/errata.json alpine/| Alpine Linux| Alpine secdb| https://secdb.alpinelinux.org/ amazon/1| Amazon Linux| Amazon Linux Security Center|...

advisory-database

Python Packaging Advisory Database これは、https://pypi.org で公開されているパッケージのアドバイザリを管理するコミュニティ所有のリポジトリです。 アドバイザリは vulns ディレクトリに格納され、シンプルな形式 の YAML エンコーディングを使用します。 アドバイザリへの貢献 プルリクエストの作成 既存のエントリは、プルリクエストを作成するだけで編集できます。 新しいエントリを追加するには、PYSEC-0000-.yaml という名前の新しいファイルを含むプルリクエストを作成してください。これは、マージ後に適切な ID...

CVE-2020-11883

CVE-2020-11883 vue-storefront-api 취약점 🛠 설정 root@kitploit: $ yarn instal $ tsnd . 🧨 예시 메시지 형식 root@kitploit: $ tsnd . 이 예시에서는 "Lights.ie" 페이지를 테스트했습니다. 🙀 면책 조항 이 애플리케이션은 테스트 목적으로만 제공되며, 발생할 수 있는 어떤 문제에 대해서도 책임을 지지 않습니다. 가능한 곳에서만 테스트하시기 바랍니다...

CVE-2019-11287

CVE-2019-11287: RabbitMQ Web Management PluginにおけるヒープオーバーフローによるDoS Pivotal RabbitMQ のバージョン 3.7.x で 3.7.21 未満、および 3.8.x で 3.8.1 未満、ならびに Pivotal Platform 向け RabbitMQ のバージョン 1.16.x で 1.16.7 未満、および 1.17.x で 1.17.4 未満には、サービス拒否攻撃に対して脆弱な Web 管理プラグインが含まれています。 "X-Reason" HTTP ヘッダーを利用して悪意のある Erlang...

The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to deficiencies in the formatting string processing mechanism. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-81925

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925

Concrete CMS versions before 9.5.3 contain a reflected cross-site scripting (XSS) vulnerability in the conversation view endpoint . A user-supplied custom date format was improperly neutralized when rendering conversation messages, allowing an attacker to execute arbitrary JavaScript in a victim'...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

EUVD-2026-79939

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-59230

A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may...

PT-2026-92515

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...