cups-script-final-project

功能说明 針對CVE-2025-58060的兩階段檢測工具，Common UNIX Printing System CUPS中的認證繞過漏洞。該工具不僅依賴版本號，還將基於Banner的版本檢查與主動認證繞過探測相結合。即使Server頭部截斷了修補版本，也能幫助確認真實的漏洞狀態。 第一階段 — 版本檢查 讀取CUPS Web介面（埠631）的Server: HTTP頭部，並將檢測到的版本與修補版本閾值2, 4, 13進行比較。如果Banner只報告CUPS/2.4（被截斷），工具會標記此情況並轉至第二階段。 第二階段 — 主動認證繞過探測 向/admin/發送精心構造的HTTP...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus 一个针对CVE-2026-38526的PoC脚本，通过webkul krayin 2.2.x的/admin/tinymce/upload端点中的文件上传漏洞实现远程代码执行（专为htb-nexus构建） 🛠 快速开始和使用 1. 克隆仓库： root@kitploit: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.git cd CVE-2026-38526-PoC-htb-nexus 2. 创建Python虚拟环境： root@kitploi...

cve-2026-20127

CVE-2026-20127 Scanner Overview This project is a Windows-based network scanning tool written in C++ that attempts to identify potential Cisco SD-WAN / vManage-like services and perform a vulnerability check against a referenced issue labeled CVE-2026-20127. Features IP range scanning start → end...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

cve-2026-23744

CVE-2026-23744 – Ejecución Remota de Código RCE sin Autenticación en MCPJam Inspector Descripción Producto : MCPJam Inspector Versiones afectadas : ≤ 1.4.2 Versión corregida : 1.4.3 Tipo : Ejecución Remota de Código RCE sin autenticación Vector de ataque : Red Autenticación requerida : No...

CVE-2026-28767

CVE-2026-28767: Falta de autenticación en el endpoint administrativo de notificaciones Aviso Campo| Valor ---|--- CVE| CVE-2026-28767 ICSA| ICSA-26-055-03 Actualización A CVSS 3.1| 5.3 Media Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-306 Falta de autenticación para función...

CVE-2026-85637

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-85637 jofpin trape Admin Endpoint sockets.py join_room missing authentication

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

EUVD-2026-71682

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function joinroom of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-85637

jofpin trape (versions 1.0.0/2.0) is affected by a missing authentication flaw in the join_room function within core/sockets.py of the Admin Endpoint component. An unauthenticated remote attacker can exploit this to access the admin endpoint, resulting in low confidentiality impact (CVSS 3.1 base...

CVE-2026-85212

CRMEB contains an authentication bypass vulnerability in the verifyAuth method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits...

CVE-2026-52111

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

CVE-2026-52111

CVE-2026-52111 affects fast-note-sync-service versions ≤ 2.13.7 . The root cause is that the admin configuration endpoint exposes the authTokenKey , enabling a remote attacker with no prior privileges to escalate their access. The vulnerability is scored CVSS 9.8 (Critical) with a network attack ...

EUVD-2026-69413

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

PT-2026-84364

Name of the Vulnerable Software and Affected Versions fast-note-sync-service versions prior to 2.13.8 Description A remote attacker can escalate privileges because the admin configuration endpoint exposes the authTokenKey variable. Recommendations Update fast-note-sync-service to version 2.13.8 o...

CVE-2026-52111

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

CVE-2026-78387

RansomLook has an authorization weakness in its web-based configuration editor at the /admin/config endpoint. The route requires an authenticated session but performs no explicit privilege or administrator authorization check , allowing any authenticated low-privileged user to write crafted value...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

EUVD-2026-64841

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...