872 matches found
drupal-cve-2026-9082-checker
DRUPAL CVE-2026-9082 检测工具 Drupal CVE-2026-9082 盲 SQL 注入检测工具 安装 root@kitploit: git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt 参考链接 https://vulners.com/cve/CVE-2026-9082 https://cwe.mitre.org/data/definitions/89.ht...
CVE-2024-23897
CVE-2024-23897 CVE-2024-23897 jenkins-cli We have seen Jenkins File Leak / RCE CVE-2024-23897 exploited in the wild and managed to reproduce it. If your Jenkins allows anonymous users or user registration, immediately update it to the latest version. java -jar jenkins-cli.jar -s...
SiYuan - SQL Execution
SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...
CVE-2025-47812-poc
CVE-2025-47812 Wing FTP Server リモートコード実行 RCE エクスプロイト CVE-2025-47812 📌 クレジット : 脆弱性は Julien @MrTuxracer によって発見されました。 この PoC 実装は彼らのオリジナル研究に基づいています。 このリポジトリは、Wing FTP Server のリモートコード実行 RCE 脆弱性 CVE-2025-47812 に対する Python エクスプロイトをホストしています。この重大な欠陥により、攻撃者は影響を受ける Wing FTP Server...
CVE-2025-47812
🚀 Wing FTP Exploit - CVE-2025-47812 Wing FTP Server CVE-2025-47812 の改良版エクスプロイト - 未認証リモートコード実行 RCE 🔧 インストール このリポジトリをクローンし、ディレクトリに移動します: root@kitploit: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r requirements.txt または、CVE-2025-47812.py...
sccm-http-looter
SCCM HTTP Looter 工作原理 SCCM 分发点（DP）是 Microsoft SCCM 用于托管软件安装、补丁、脚本部署等所用全部文件的服务器。默认情况下，这些服务器允许通过 SMB（TCP/445）和 HTTP/S（TCP/80 和/或 TCP/443）进行访问，并且需要某种类型的 Windows 身份验证（即 NTLM）。 当前的 SCCM DP 文件提取工具依赖于浏览 SMB 共享来收集文件的能力。 CMloot cmloot 然而，组织限制内部网络服务器上的入站 SMB 访问并不少见，并且阻止来自互联网的入站 SMB 访问也是标准做法。另一方面，HTTP/S...
EUVD-2026-75705
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...
CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...
DEBIAN-CVE-2026-88044
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...
EUVD-2026-75587
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...
Quest KACE System Management Appliance 8.0.318 - Remote Code Execution
The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system. id: CVE-2018-11138 info: name: Quest KACE System Management Appliance 8.0.318 - Remote Code Executi...
Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...
DRUPAL-CONTRIB-2026-152
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...
POC-2020-8559
POC-2020-8559 CVE-2020-8559的利用。我们使用iptables劫持所有到kubelet的连接，然后将101或302响应重写为307。101用于现代Kubernetes版本，302用于较旧版本。 我们无法访问kube-apiserver的x509证书，因此kubelet webhook认证可能成为问题。使用这个kubelet配置片段就没有问题，它基本上重新启用了旧式的kubelet利用： root@kitploit: authentication: anonymous: enabled: true authorization: mode: AlwaysAllow...
GHSA-V684-Q882-JGMQ SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked
CVE: This vulnerability corresponds to CVE-2026-72789. Summary publishAccess.json is an opt-out list. The publish gate returns accessible for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated setPublishAccess writes it...
EUVD-2026-57453
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers...
GHSA-H6W7-XXCF-W2MQ SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72795. Summary /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed gate only the requested block against publish access. The blocks pulled in by that block's embed transclusion query are inlined into the returned DOM with no...
EUVD-2026-57456
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers...
GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...