CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2025-65964

n8n Git Hooks CTF Demo ⚠️ Este repositorio es solo para fines educativos y de demostración de CTF. Escenario Una plataforma de automatización por ejemplo, n8n utiliza operaciones de Git como parte de un flujo de trabajo. El flujo de trabajo permite la configuración arbitraria de Git mediante git...

poc-proxycommand-vulnerable

RCE через небезопасный /.ssh/config Использование токенов, таких как %h, %p, в ProxyCommand довольно популярно для организации туннелей и проксирования соединений через SSH. Уязвимая конфигурация root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p...

poc-proxycommand-vulnerable

RCE via insecure /.ssh/config Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH. Vulnerable config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Note: in my initial assessment I was under the...

guardskill

GuardSkill A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do. root@kitploit: npx guardskill . Read-only. No network calls, no telemetry, no config, no account. It reads git configuration and hook scripts, prints what it found...

CVE-2020-25498

CVE-2020-25498: XSS almacenado mediante CSRF en el router Beetel 777VR1 Descripción de la vulnerabilidad Se ha identificado que el endpoint vulnerable no tiene validación de entrada en el lado del servidor y carece de filtrado en el lado del cliente frente a cualquier inyección de script malicios...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 Corrección de PowerShell Este script de PowerShell corrige CVE-2021-36934, basado en el script original de Joran Slingerland https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 El script de PowerShell ha...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - Lectura Arbitraria de Archivos en el Plugin File Away de WordPress 📋 Resumen Ejecutivo CVE ID: CVE-2025-2539 Plugin: File Away Versiones = 3.9.9.0.1 Tipo de Vulnerabilidad: Lectura Arbitraria de Archivos Autenticada Puntuación CVSS: 8.5 Alta Disponibilidad de Exploit: PoC Público...

Security Advisory 0178

Security Advisory 0178 PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-73440 CVSSv3.1 Base Score: 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSSv4.0 Base Score: 2.3...

TencentOS Server 3: httpd:2.4 (TSSA-2026:1002)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1002 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106765)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106765 advisory. An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attribut...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

redis-exploitation

redis-exploitation CONFIG SET For educational purposes only Build root@kitploit: $ docker build -t victim . Run root@kitploit: $ docker run -d --name victim victim Attack root@kitploit: $ docker exec -it victim bash root@kitploit: root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 /...

CVE-2025-49132_poc

CVE-2025-49132poc Ejemplo de uso 1. Escanear un solo objetivo : root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. Escanear una lista de objetivos : root@kitploit: python3 CVE-2025-49132poc.py -f listaobjetivos.txt 3. Guardar resultados del escaneo : root@kitploit:...

CVE-2026-78625

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-78545

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

EUVD-2026-74173

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-78552

CVE-2026-78552 is a validation bypass in Okta Access Gateway where the application-level custom configuration field is not subject to the same Lua directive restriction as other fields. Because this field is interpolated directly into the nginx server block without inspection, an authenticated us...

EUVD-2026-74163

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...