fastjson-1.2.60-rce

Fastjson = 1.2.60 反序列化漏洞 By Pass autoType Block List with 2 Gadgets JNDIConfiguration、OracleManagedConnectionFactory Gadgets root@kitploit: 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。 另外的两个类JNDIConfiguration和...

e-cology

泛微e-cology OA Beanshell组件远程代码执行 Windows Linux Ps root@kitploit: 检测目标系统os.name（因为目标系统是windows的话，执行set等命令，需要手动敲cmd.exe /c set） 使用Unicode绕过exec过滤，部分站点 Payload root@kitploit: bsh.script=exec'whoami'; unicode bypass bsh.script=\u0065\u0078\u0065\u0063"whoami"; Useful BeanShell Commands root@kitploit: ...

cve-2020-13933

cve-2020-13933 cve-2020-13933 vulnerabilidad de omisión de autenticación de Apache Shiro Esta reproducción es muy simple, primero configurar el entorno con IDEA+shiro Referencia: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Luego ejecutar, acceder, capturar el tráfico...

gitlab-SSRF-redis-RCE

gitlab-SSRF+CRLF-Redis-RCE GitLab 11.4.7 SSRF+CRLF注入 配合Redis远程执行代码 0x00 Vulnerability environment root@kitploit: root@kali: cd gitlab-docker root@kali: docker-compose up -d root@kali: docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES cf8c38aef669 gitlab/gitlab-ce:11.4.7-ce.0...

mimikat_ssp

mimikatssp windows 密码抓取绕杀毒...

CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-

CVE-2026-8080 – DKIM 签名验证绕过（头部规范化缺陷） 程序代码（Python 邮件解析模拟） root@kitploit: dkimverifiersim.py - Flawed DKIM verifier import re, hashlib Simulated email with DKIM signature rawemail = b"""From: [email protected] To: [email protected] Subject: Hello DKIM-Signature: v=1; a=rsa-sha256;...

CVE-2026-5050-Blind-LDAP-Injection-via-Unescaped-Filter

CVE-2026-5050 – 未转义过滤器导致的盲 LDAP 注入 程序代码（使用 Python 与 ldap3 模拟） root@kitploit: ldapserversim.py - Simulated LDAP authentication server from flask import Flask, request, jsonify app = Flaskname Fake user database USERS = 'admin': 'password': 'secret', 'role': 'admin', 'user': 'password': 'pass',...

CVE-2026-65591

CVE-2026-65591 Nombre del software vulnerable y versiones afectadas Versiones de n8n anteriores a la 1.123.64 Versiones de n8n anteriores a la 2.29.8 Versiones de n8n anteriores a la 2.30.1 Descripción Existe una omisión del saneador sanitizer en el manejador de miembros calculados del evaluador ...

about_cobaltstrike4.5_cdf

aboutcobaltstrike4.5cdf cobaltstrike4.5版本破解、去除checksum8特征、bypass BeaconEye、修复错误路径泄漏stage、增加totp双因子验证、修复CVE-2022-39197等 如果您在寻找这个项目：cobaltstrike4.5cdf 是的它又被封了：Repository unavailable due to DMCA takedown. 如果您对原文中的不涉及软件版权的去除checksum8特征、bypass...

CVE-2026-18963-Exploit

CVE-2026-18963 — Keycloak reset-credentials 绕过 → 未认证账户接管 仅凭用户名或电子邮件地址 ，未认证的攻击者即可在任何 Keycloak 账户上设置一个 任意密码。密码重置电子邮件会发送 给真正的受害者，但攻击者完全不需要它 — 攻击者从不读取邮箱，从不 点击链接，也不持有任何先前的凭据或会话。 受影响：Keycloak 26.0.0 – 26.7.1。已在 26.7.2 中修复。 我是否易受攻击？ 一条命令。无需有效用户名，且无副作用 — 它不会发送 电子邮件，不会写入任何账户，并会在可利用步骤之前停止。bash git clone...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. 将 zbxsignedsession 替换为 cookie 2. 使用单点登录（SAML）登录 作者：@random-robbie、@jweny 和 @Mr-xn 链接：https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

CVE-2026-66422

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-65905

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-82816

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

CVE-2026-79746

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

EUVD-2026-68720

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001

Pangolin versions prior to 1.22.0 contain an authentication bypass in the share-link endpoint. The root cause is that an attacker-controlled URL parameter can omit the expected resource identifier from the token verification call, allowing a holder of a single valid share link to authenticate aga...

CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...