Tenda AC1200 V-W15Ev2 - Authentication Bypass

The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...

CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF extended Berkeley Packet Filter programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivit...

CVE-2026-80213

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

CVE-2026-82660

A flaw was found in Nodemailer, a module for sending emails. The jsonTransport component, responsible for handling message data, does not correctly enforce security options designed to prevent unauthorized file and URL access. A remote attacker could exploit this by sending specially crafted...

cve-2023-22515-lab

cve-2023-22515-lab CVE-2023-22515 を実演するハンズオンセキュリティラボ — シミュレートされた脆弱な環境を使用した Atlassian Confluence 認証バイパス。...

CVE-2026-82659

A flaw was found in nodemailer. Authenticated attackers can bypass security flags by crafting raw messages with specific file paths or URLs. This allows them to read arbitrary files from the system or perform Server-Side Request Forgery SSRF, potentially leading to information disclosure or...

CVE-2026-81727

A flaw was found in NLTK. This vulnerability, a filesystem containment bypass, allows a local attacker with write access to a shared downloader directory to create special links hardlinks that point to files outside the intended installation area. When a package is extracted, these hardlinks can...

WP2Shell

WP2Shell - WordPress 事前認証 RCE エクスプロイト CVE-2026-63030 + CVE-2026-60137 バージョン: 4.0.0 作者: G0D150NE 📌 概要 WP2Shell は、WordPress の事前認証リモートコード実行（RCE）のためのフルチェーンエクスプロイトツールです。このツールは、2 つの重大な脆弱性を組み合わせています： CVE-2026-63030 - REST API バッチエンドポイントにおける SQL インジェクション CVE-2026-60137 - oEmbed キャッシュポイズニングによる認証バイパス...

CVE-2012-2122-Home-Lab

CVE-2012-2122 MySQL 認証バイパス ホームラボ このラボは、CVE-2012-2122 - MySQL 認証バイパス の脆弱性をデモンストレーションするものです。 MySQL 5.5.23 以前のバージョンにおけるパスワード比較のエラーが原因で発生します。 攻撃者が間違ったパスワードを繰り返し送信すると、MySQL が誤ってログインを許可してしまう可能性があります。 特徴 vulhub/mysql:5.5.23 をベースに使用 entrypoint.sh スクリプトでフラグを自動生成 フラグは /tmp/flag.txt に配置 docker restart...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO 장치 인증 우회 익스플로잇 설명: 일부 Dahua 제품에서 로그인 과정 중 발견된 신원 인증 우회 취약점입니다. 공격자는 악성 데이터 패킷을 구성하여 장치 신원 인증을 우회할 수 있습니다. root@kitploit: python3 dahuaexploit.py --ip IP --port PORT...

polkit-CVE-2021-3560_writeup

Try Hack Me - Polkit:CVE-2021-3560 작성자: Atharva Bordavekar 난이도: 정보 포인트: 32 취약점: CVE-2021-3560 먼저 polkit 버전을 확인하여 더 나은 통찰력을 얻을 것입니다. root@kitploit: apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1 amd64 installed,upgradable to: 0.105-26ubuntu1.1 저는 deepseek를 사용하여 polic...

BIT-GITLAB-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Important: Red Hat Security Advisory: runc security update

An update for runc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-66698

CVE-2025-66698 대상 소프트웨어: Veda Semantic Machines v5.4.8 이전 버전 대부분 포함. 취약점 유형: 인증 우회. CVE ID: CVE-2025-66698. 요약: 시스템이 ticket 매개변수를 부적절하게 검증하여, 빈 문자열을 유효한 세션으로 처리합니다. 프로젝트 링크: Veda Semantic Machines 2025년 11월 18일: 발견 및 초기 CVE 요청. 2026년 1월 9일: CVE ID 할당. 공급업체에 연락 시도 무시 및 삭제됨. 2026년 1월 13일: 공급업체의 응답...

CVE-2025-29927

CVE-2025-29927 — Next.js ミドルウェア認可バイパス 概要: Next.js のミドルウェアにおける脆弱性で、x-middleware-subrequest ヘッダーを偽装することで認可チェックをバイパスできます。 目次 CVE-2025-29927 — Next.js ミドルウェア認可バイパス 目次 脆弱なホストの収集 詳細情報 概要説明 脆弱性の詳細 CWE Weakness Enumeration 影響と追加リスク 影響を受けるバージョン CVSS とメトリクス PoC — ローカルでの安全な再現 マスチェック nuclei, Python Nuclei...

CVE-2025-12758

CVE-2025-12758: Validator.js isLength Unicode Variation Selector 우회 CVE ID: CVE-2025-12758 CVSS Score: 8.7 HIGH Severity: HIGH CWE: CWE-792 특수 요소의 하나 이상 인스턴스에 대한 불완전한 필터링 Published: 2025년 11월 26일 Disclosed: 2025년 10월 19일 취약점 개요 이 취약점은 validator npm 패키지 버전 13.15.22에 영향을 미칩니다. isLength 함수가 문자열 길이를...

CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to...

CVE-2026-40205

A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not...

cve-2025-25257

CVE-2025-25257 - 実験環境 実験アーキテクチャ 環境はFortiWebの脆弱なコンポーネントをシミュレートします root@kitploit: 脆弱なエンドポイント : /api/system/fabric/config インジェクションベクター : HTTP Authorization: Bearer ヘッダー メカニズム : 直接SQL連結 Pythonのf-string 認証 : なし 完全バイパス データベース : SQLite デモ用 cve-2025-25257 ├── Dockerfile ├── docker-compose.yml ├──...