WordPress Advanced Access Manager - Path Traversal

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive file...

XWiki Platform - Information Disclosure

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. id: CVE-2025-55747 info: name: XWiki Platform - Information Disclosure author: Redmomn...

LiteLLM - Arbitrary File Read

LiteLLM 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts. id: CVE-2026-35029 info: name: LiteLLM - Arbitrary File Read...

MotionEye Config Info Disclosure

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. id: CVE-2022-25568 info: name: MotionEye Config Info Disclosure author: DhiyaneshDK severity: high...

Apache Solr - Deserialization of Untrusted Data

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. id:...

Spring Cloud Config Server - Path Traversal

Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...

DataTaker DT80 dEX 1.50.012 - Information Disclosure

DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/o...

Progress ShareFile Storage Zones Controller - Authentication Bypass

Customer Managed ShareFile Storage Zones Controller SZC contains an authentication bypass Execution After Redirect that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution. id: CVE-2026-2699 inf...

CAPE-parsers

CAPE-parsers Parsers principales y de la comunidad de CAPE Estructura de configs root@kitploit: CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any othe...

git-fsmonitor

这是一个已被记录（已知）的问题，但我在研究过程中发现了它，并且它对红队/渗透测试非常有用。 摘要： git 会在每次执行 git status、git diff 等命令时运行 FSMonitor 辅助程序，因此 git 会盲目地启动我们指定路径下的任何内容。我们的 IDE 在打开文件夹时会自动运行 git status 以填充其 SCM（源代码管理）面板； 这使得 git 能够生成配置好的辅助程序，从而执行攻击者控制的代码。这种技术可用于红队行动或假设已被攻破的场景中，配合任何 C2 或我们的 XRayC2 获取回调，从而绕过传统网络防御。（当然，需要发送钓鱼邮件来欺骗最终用户，但在 I...

HikvisionExploiter

HikvisionExploiter HikvisionExploiter es un potente kit de herramientas de explotación automatizada dirigido a endpoints no autenticados en cámaras IP Hikvision , en particular las que ejecutan la versión de firmware 3.1.3.150324. Realiza: Verificación de acceso a instantáneas snapshots...

CVE-2025-8110

Gogs RCE 漏洞利用 CVE-2025-8110 针对 CVE-2025-8110 的概念验证 PoC 程序，这是 Gogs 中的一个严重漏洞，允许通过符号链接绕过和 sshCommand 注入操纵 .git/config 来实现远程代码执行 RCE。 📖 概述 此漏洞利用针对 Gogs API 内容管理中的路径遍历缺陷。已认证用户可以： 1. 创建一个仓库并推送一个指向内部 .git/config 的符号链接 。 2. 使用 API 通过符号链接覆盖目标配置文件。 3. 注入恶意的 sshCommand，当服务器执行 Git 操作时触发反向 Shell 。 🚀 特性 自动化工作流...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

spybrowse

BrowseSpy Be sure to change the ftp variables throughout the code, these variables contain the username, password, & IP address of the FTP server which receives the files. This code will do the following: 1. Copy itself into the %TMP% directory & name itself ursakta.exe 2. Add a registry entry to...

CVE-2023-24055

CVE-2023-24055 CVE-2023-24055 的 POC 和扫描器 使用风险自负！ configscanner.py 一个简单的解析器，用于运行在 Windows 下的 KeePass 配置文件。 该工具将打开目录 %APPDATA%\Roaming\KeePass\KeePass.config.xml 并输出所有触发器。这些触发器 执行命令行/URL 将活动数据库与文件/URL同步 导出活动数据库 被标记为危险。这是我个人的看法，我相信你也可以通过其他一些操作执行恶意行为！ 提示：如果你不认识某些触发器，请仔细检查它们！ poc.py CVE-2023-24055...

bluez

BlueZ - Pila de protocolos Bluetooth para Linux Copyright C 2000-2001 Qualcomm Incorporated Copyright C 2002-2003 Maxim Krasnyansky [email protected] Copyright C 2002-2010 Marcel Holtmann [email protected] Compilación e instalación Para compilar las utilidades de Bluetooth necesitas los...

CVE-2022-23642

Sourcegraph Gitserver 3.37.0 RCE 的 PoC CVE-2022-23642 Sourcegraph 3.37.0 之前的版本在其 gitserver 服务上存在一个远程代码执行漏洞。这是由于对 git config 执行缺乏限制，因此可以在 HTTP 参数中传递 "core.sshCommand"，其中可以包含任意 bash 命令。请注意，只有 gitserver 暴露给攻击者时才能利用此漏洞。该漏洞已在 Sourcegraph 3.36.3 上测试。 Docker 测试设置 测试中使用了 Sourcegraph Docker 容器版本...

Medusa

Medusa Medusa 是一个跨平台代理，兼容 Python 3.8 和 Python 2.7。 安装 要安装 Medusa，你需要在远程计算机上安装 Mythic v3。你可以在 Mythic 项目页面 找到 Mythic 的安装说明。 在 Mythic 安装根目录下，运行以下命令： ./mythic-cli install github https://github.com/MythicAgents/Medusa.git 安装完成后，重启 Mythic 以构建新代理。 RabbitMQ 配置说明 文件 PayloadType/medusa/rabbitmqconfig.json...

CVE-2026-71557-poc

CVE-2026-71557: PoC de path traversal en el nombre de referencia de go-git Versión en inglés Resumen Este repositorio es un PoC local seguro de CVE-2026-71557 , basado en el aviso público de go-git GHSA-qgq7-7hm3-q39j. La versión anterior de storage/filesystem no validaba suficientemente el nombr...

raccoon_config

raccoonconfig Escanea una lista de servidores raccoon de Tria.ge y extrae la configuración como JSON. Si lo deseas, también puede enviar automáticamente el malware adicional extraído de la configuración de Raccoon a Tria.ge Se requiere clave de API Recursos: Logo:...