Roundcube_CVE-2025-49113

在 Roundcube 中的 RCE CVE-2025-49113 - 我的 Obsidian 笔记 .md date time 状态: 完成 实验室: 简单 标签: RCE | PHP | LABTHM | EXPLOIT | CVE 作者: KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script 影响 : 登录后远程命令执行 CVSS 9.9 受影响版本 : ≤ 1.5.10 / 1.6.10 已修复 : 1.5.11 和 1.6.11 1 – 时间线...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2026-25212

CVE-2026-25212 – Percona PMM RCE PoC Kritisch – CVSS 9.9 – Authentifizierte Remote-Codeausführung in PMM 3.7. Beschreibung Dieser Proof-of-Concept nutzt eine Schwachstelle aus, bei der ein interner PostgreSQL-Benutzer in PMM 'SUPERUSER'-Rechte behält. Ein authentifizierter Angreifer mit...

CVE-2025-31337

CVE-2025-31337 Sicherheitshinweis CVE ID: CVE-2025-31337 Veröffentlicht: 2025-03-15 CVSS-Score: 9.8 Kritisch CWE: CWE-120 Pufferkopie ohne Überprüfung der Eingabegröße Beschreibung Eine kritische Pufferüberlauf-Schwachstelle wurde im AIDR ChatBot Framework Version 4.2.0 und früher entdeckt. Die...

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947EXP,CVE-2022-22947RCE Использование Обратная оболочка reverse shell python3 CVE-2022-22947.py целевой URL IP для обратной оболочки порт Выполнение команды python3 CVE-2022-22947.py целевой URL команда...

CVE-2024-4577-RCE-PoC

CVE-2024-4577 RCE Эксплойт При реализации PHP команда не заметила функцию Best-Fit преобразования кодировок в операционной системе Windows. Это упущение позволяет неаутентифицированным злоумышленникам обойти предыдущую защиту CVE-2012-1823 с помощью определённых последовательностей символов...

CVE-2026-71171

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

CVE-2026-54245

Fleet (open-source device management platform built on osquery) has a SQL injection in the Okta conditional access integration available in Fleet Premium. A value reported by a host's own agent is stored verbatim and then used in a database query without proper parameterization on an unauthentica...

CVE-2026-44402

CVE-2026-44402 Esecuzione Remota Completa di Comandi senza autenticazione in Voltronic Power SNMP Web Pro 1.1 Contenuto Vendor interessato: https://voltronicpower.com/ Prodotto interessato: SNMP Web pro 1.1 SNMP Web Pro 1.1 contiene una vulnerabilità di esecuzione remota di codice non autenticata...

CVE-2020-10199

CVE-2020-10199 Prima, durante un PT penetration test, mi sono imbattuto in un ambiente target con un Nexus Repository Manager installato; dopo alcuni intoppi sono comunque riuscito a ottenere una shell. Ho deciso di documentare l'accaduto, così in futuro sarà più semplice rivedere i passaggi...

wp2shell-poc

wp2shell-poc Proof-of-concept indipendente per l'iniezione SQL blind basata su confusione di route del batch REST non autenticato di WordPress, associata all'avviso wp2shell di Searchlight Cyber. Questo repository non è il checker ufficiale di Searchlight Cyber. check conferma il percorso SQLi,...

CVE-2026-68861

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

EUVD-2026-66666

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-68861

Dell PowerProtect One , versions 20.1.0.0 and below , are affected by an OS Command Injection vulnerability (Improper Neutralization of Special Elements used in an OS Command). A low-privileged attacker with remote access could exploit this to achieve remote code execution , resulting in high imp...

mariana-trench

Mariana Trench Mariana Trench is a security focused static analysis platform targeting Android. This guide will walk you through setting up Mariana Trench on your machine and get you to find your first remote code execution vulnerability in a small sample app. These instructions are also availabl...

git-dumper

git-dumper Uno strumento per scaricare un repository git da un sito web. Installazione Può essere installato facilmente con pip: root@kitploit: pip install git-dumper Utilizzo root@kitploit: usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR...

EUVD-2026-66658

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...

CVE-2026-71171

Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability in its REST API . A high-privileged attacker with remote access could exploit it to achieve remote code execution , with full impact on confidentiality, integrity, and availability. The CVSS 3.1 sco...