pwn_jenkins

원격 코드 실행 Jenkins CLI 임의 읽기 CVE-2024-23897은 2.442 미만 및 LTS 2.426.3 미만 버전에 적용 Jenkins 권고, 크레딧 인증된 경우, 전체 파일을 검색할 수 있습니다: root@kitploit: java -jar jenkins-cli.jar -noCertificateCheck -s https://xxx.yyy/jenkins -auth abc:abc connect-node "@/etc/passwd" 인증되지 않았거나 Global/Read 권한이 없는 경우, 3줄만 읽을 수 있습니다: ...

DashOverride

DashOverride Qué Este es un exploit de RCE pre-autenticado para VMware vRealize Operations Manager vROPS que afecta a las versiones Ejecución ro...

randy

Randy 개요 이것은 Inductive Automation Ignition의 사전 인증 RCE 익스플로잇으로, 버전 = 8.1.16에 영향을 미칩니다. 우리는 Pwn2Own Miami 2022에서 조잡한 익스플로잇과 디버그 환경이 없어 취약점을 악용하는 데 실패했지만, 그 이후로 시간과 에너지를 찾아 개선했습니다! 작성자 Incite Team의 Chris Anastasio와 Steven Seeley mrme 빌드 1. mvn clean compile assembly:single -DskipTests로 빌드하십시오. 테스트 이...

CVE-2026-19294

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

CVE-2026-18899

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal...

CVE-2026-18891

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

PoC

PoC разные PoC — интернет небезопасных вещей Определённо стоит почитать про эти паршивые небезопасные вещи: https://ipvm.com/reports/security-exploits Hikvision CVE-2021-36260 2021-10-19 Вся заслуга принадлежит WatchfulIP https://watchfulip.github.io/...

routers-exploit

OpenSource-репозиторий с PoC и уязвимостями, найденными в роутерах TP LINK TL-WR849N - PoC удаленного выполнения команд CVE-2020-9374 - TP LINK TL-WR849N - PoC удаленного выполнения команд root@kitploit: Полезная нагрузка: "$ls" TP LINK TL-WR849N - Обход аутентификации: обновление прошивки и...

itsm-exploit

Эксплойты для Ivanti Neurons for ITSM On Premise Этот скрипт эксплуатирует несколько уязвимостей, которые позволяют неаутентифицированному злоумышленнику получить доступ администратора и выполнять удалённые команды CVE-2023-46808 на Ivanti Neurons for ITSM On Premise. Технические подробности см. ...

CVE-2025-5777-TrendMicro-ApexCentral-RCE

🚨 CVE-2025-5777 – Trend Micro Apex Central Bypass dell'autenticazione + RCE 🔎 Panoramica CVE-2025-5777 è una vulnerabilità critica di bypass dell'autenticazione ed esecuzione remota di codice RCE scoperta in Trend Micro Apex Central. Consente ad attaccanti non autenticati di eseguire comandi...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-81518

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — WordPress Privilege Escalation Exploração prática de vulnerabilidade crítica no WordPress usando o plugin WooCommerce Payments. 📌 Resumo A CVE-2023-28121 permite criar usuários administradores sem autenticação via REST API. Severidade: Crítica CVSS 9.8 Impacto: Controle total d...

OSWE-Labs-Poc

OSWE -LABS Lab dockerizzati per la certificazione Web Expert OSWE. Preparazione per il prossimo corso AWAE ... Altro progetto : analisi malware & cyber threat hunting https://github.com/svdwi/BlueBox Lab disponibili per la OSWE 1. ATutor è un sistema open source di gestione dei contenuti per...

List-CVE-2025-2026

CVE-2025-69412 - O KDE messagelib anterior à versão 25.11.90 ignora erros SSL para threatMatches:find na API Google Safe Browsing Lookup também conhecida como API de phishing, o que pode permitir ... 2. CVE-2025-69413 - No Gitea anterior à versão 1.25.2, /api/v1/user tem respostas diferentes...

espoofer

espoofer espoofer é uma ferramenta de teste de código aberto para contornar a autenticação SPF, DKIM e DMARC em sistemas de e-mail. Ela ajuda administradores de servidores de e-mail e testadores de penetração a verificar se o servidor de e-mail de destino e o cliente são vulneráveis a ataques de...

CVE-2020-1472

ZeroLogon-Testskript Ein Python-Skript, das die Impacket-Bibliothek verwendet, um die Schwachstelle für den Zerologon-Exploit CVE-2020-1472 zu testen. Es versucht, die Netlogon-Authentifizierungsumgehung durchzuführen. Das Skript wird sofort beendet, wenn die Umgehung erfolgreich durchgeführt...

CVE-2025-13315

🛡️ CVE-2025-13315 – Kritischer Authentifizierungs-Bypass im Twonky Server 8.5.2 -e63939?style=for-the-badge Ein nicht authentifizierter Angreifer kann die API-Authentifizierung umgehen, Admin-Anmeldedaten aus Logs extrahieren und vollen Administratorzugriff erlangen. 📋 Überblick CVE-2025-13315 ist...

Nuclei-Template-Exploit-F5-BIG-IP-iControl-REST-Auth-Bypass-RCE-Command-Parameter

Nuclei Template Exploit F5 BIG-IP iControl REST Auth Bypass RCE | Parametro Comando CVE-2022-1388 è una vulnerabilità di bypass dell'autenticazione nel componente REST dell'API iControl di BIG-IP a cui è stato assegnato un punteggio CVSSv3 di 9.8. L'API REST iControl è utilizzata per la gestione ...