R2SAE

R2SAE - React2Shell Auto-Exploit Un'estensione Firefox per rilevare e sfruttare CVE-2025-55182 Vulnerabilità di Prototype Pollution nelle React Server Actions Caratteristiche • Installazione • Utilizzo • Disclaimer ⚠️ Disclaimer Questo strumento è destinato esclusivamente a test di sicurezza...

CVE-2025-55182-RCE-Exploit

POC für CVE-2025-55182 – Remote-Code-Ausführung in Next.js 16.0.6 Dieses Repository enthält einen funktionierenden Proof-of-Concept POC für CVE-2025-55182 , eine kritische Deserialisierungsschwachstelle, die Next.js 16.0.6 betrifft. Der Exploit missbraucht die $@-Chunk-Deserialisierung und...

killchain

killchain “Kill Chain” is a unified console with an anonymizer that will perform these stages of attacks: Reconnaissance Weaponization Delivery Exploit Installation Command & Control And Actions Dependent tool sets are: 1...

react-cve-2025-55182

CVE-2025-55182: React/Next.js Teste Status do Projeto: Experimental / Prova de Conceito Este repositório serve como um ambiente de pesquisa controlado e um framework de Prova-de-Conceito PoC para analisar CVE-2025-55182. Ele demonstra uma vulnerabilidade de Poluição de Protótipo no contexto de...

CVE-2025-66478-Exploit-Poc

Next.js CVE-2025-66478 PoC English | 한국어 Dieses Repository enthält einen Proof of Concept PoC zur Reproduktion und Erforschung der Next.js-Schwachstelle CVE-2025-66478. Es besteht aus einer verwundbaren Next.js-Anwendung und einem Python-Exploit-Skript zum Testen der Schwachstelle. Was ist...

metta

Metta Metta è uno strumento di preparazione per la sicurezza informatica. Questo progetto utilizza Redis/Celery, Python e Vagrant con VirtualBox per eseguire simulazioni avversarie. Ciò ti consente di testare principalmente la strumentazione basata su host, ma potrebbe anche permetterti di testar...

CVE-2024-57373

Vulnerabilità CSRF in LifestyleStore v1.0 📌 Panoramica Questo repository documenta una vulnerabilità di Cross-Site Request Forgery CSRF identificata nel progetto LifestyleStore v1.0. Il difetto consente agli attaccanti di eseguire azioni non autorizzate per conto di utenti autenticati, comportand...

CVE-2021-38314

CVE-2021-38314 Python-Exploit Detail Das Plugin Gutenberg Template Library & Redux Framework Beispiel-PoC - https://youtu.be/n1e4aFmXvOk Links CVE-2021-38314...

cve-2026-31431

CVE-2026-31431 Copy Fail Test Questo repository contiene un file di workflow per GitHub Actions per verificare se il runner delle azioni è affetto da CVE-2026-31431. Puoi eseguire il test da solo: basta creare un repository da questo template e attivare manualmente il workflow test.yml ricorda di...

fix-CVE-2020-15228

Ripara CVE-2020-15228 set-env, add-path in Github-Actions Questo script modifica le righe nel tuo file di azioni GitHub. Gli fornisci un nome di directory e cerca tutti i file con estensione ".sh" o ".yml". Riconosce queste righe: root@kitploit: echo ::set-env name=FOOBAR::$FOOBAR echo ::set-env...

CVE-2026-39866

CVE-2026-39866 — अनकोटेड वर्कफ़्लो डिस्पैच इनपुट के माध्यम से कमांड इंजेक्शन GitHub Actions वर्कफ़्लो डिस्पैच में कमांड इंजेक्शन के लिए प्रूफ-ऑफ-कॉन्सेप्ट लैब उद्देश्य CVE-2026-39866 Lawnchair के GitHub Actions रिलीज़ वर्कफ़्लो में एक कमांड इंजेक्शन बग है। releaseupdate.yml फ़ाइल उपयोगकर्ता इनपुट...

KevinLAB BEMS 1.0 - SQL Injection

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through inputid POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

Langflow - Broken Access Control

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

CData Sync < 23.4.8843 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - r...

WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting

A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter. id: CVE-2011-5106 info: name: WordPress Plugin Flexible Custom Post Type 0.1.7 - Cross-Site...

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...