CVE-2020-17456

描述 2020年8月21日，发现 Seowon SLC 130 路由器存在一个认证远程代码执行漏洞。漏洞编号为 cve-2020-17456。该漏洞是由于路由器 Web 服务诊断功能中的 ping 命令注入引起的。结合多组硬编码凭据，未经授权的攻击者可以绕过认证并以 root 权限在目标设备上执行任意命令。 使用方法 root@kitploit: python CVE-2020-17456.py http://192.168.1.1 id 示例： 其他 如果你想阅读关于 SLC-130 和 SLR-120S 路由器漏洞利用的完整文章，请访问以下页面：...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

SleepyCrypt

SleepyCrypt Una función de shellcode para cifrar la imagen de un proceso en ejecución en memoria mientras duerme. Este es el código complementario de mi publicación de blog aquí. Compilación Solo ejecuta build.sh para compilar el código C, extraer la sección .text como shellcode y compilarlo en u...

ed25519-unsafe-libs

ed25519-unsafe-libs Ataque de oráculo a la función de firma con doble clave pública sobre Ed25519 Una lista de librerías de firmas ed25519 potencialmente inseguras que permiten una api pública donde la clave secreta y la clave pública pueden proporcionarse de forma independiente como entradas de ...

gimphash

gimphash gimphash is a proposed method to calculate an imphash equivalent for Go binaries. It's name stands for G o-imp ort-hash. Golang binaries contain their dependencies as part of the executable. These dependencies include both standard library packages and third party dependencies and can be...

CVE-2025-49223-BillboardJS-PoC

💥 CVE-2025-49223 - Contaminación de prototipos en Billboard.js Se descubrió que las versiones de billboard.js anteriores a la 3.15.1 contienen una contaminación de prototipos a través de la función generate, lo que podría permitir a los atacantes ejecutar código arbitrario o provocar una Denegaci...

CVE-2026-82644

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS (specifically qubes-core-dom0-linux before 4.3.22 ) is vulnerable to OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube. The root cause is the use of the system() library function in core-admin-linux/file-copy-vm/qfile-dom0-agent.c to process an er...

EUVD-2026-68212

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

CVE-2024-44337

CVE-2024-44337 包“github.com/gomarkdown/markdown”是一个 Go 库，用于解析 Markdown 文本并呈现为 HTML。在伪版本 'v0.0.0-20240729232818-a2a9c4f' 对应于提交'a2a9c4f76ef5a5c32108e36f7c47f8d310322252'...

VivisectION

VivisectION: conjunto de herramientas de reversing impulsado por emulación VivisectION es la intersección de Reversing de GUI, Emulación y Depuración, con énfasis en el uso de la emulación y otras potentes herramientas de Vivisect para ayudar en la ingeniería inversa y la investigación de...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

CVE-2026-66491

Lectura arbitraria de archivos mediante getSource en PhocaCommander PhocaCommander ≤ 6.1.3 — Path Traversal autenticado de administrador, sin CSRF requerido RESUMEN Existe una vulnerabilidad de lectura arbitraria de archivos en el endpoint del editor de archivos de PhocaCommander. La función...

Undocumented-RCE-in-PLY

Undocumented Remote Code Execution in PLY CVE‑2025‑56005 root@kitploit: CVE ID: CVE‑2025‑56005 Disclosure Date: July 1, 2025 Affected Product: PLY Python Lex‑Yacc Affected Version: 3.11 PyPI distribution Vendor: PLY Python Lex‑Yacc Affected Component: ply/yacc.py — LRTable.readpickle via...

Uncaught Exception

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable,...

Uncaught Exception

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable, reached from...

PT-2026-83584

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description Broken access control in profile function.php allows authenticated users with low privileges to view the future role memberships of other users. This is achieved by bypassing profile-level...

CVE-2026-82417

CVE-2026-82417 is a synchronous crash in the qs query-string library (Node.js). utils.isBuffer in lib/utils.js duck-types Buffer objects by invoking obj.constructor.isBuffer(obj) after only a truthy check, so any object carrying its own constructor property with a truthy, non-callable isBuffer me...