CVE-2023-48084

CVE-2023-48084 POC の壊れた構文を修正します。主に誤ったインポートと API 関数への誤った参照です。 APIToken の取得を自動化し、トークンを変数に格納して、修正済み POC にパイプします。 https://github.com/Hamibubu/CVE-2023-48084 何らかの理由でこれが機能しない場合は、上記のリンク先の依存関係のソースを diff チェックし、私の変更を元に戻してください。 インストール root@kitploit: git clone https://github.com/bucketcat/CVE-2023-48084 cd...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 のIP制限バイパスとデフォルトのadmin AIPトークンを使用したリモートコード実行 完全なウォークスルー https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2021-41805

CVE-2021-41805 HashiCorp Consul 通过 API 远程代码执行 HashiCorp Consul Enterprise 在 1.8.17 之前、1.9.x 在 1.9.11 之前以及 1.10.x 在 1.10.4 之前存在不正确的访问控制。一个命名空间中的 ACL 令牌（具有默认 operator:write 权限）可用于在另一个不同的命名空间中实现意外的权限提升。 摘要 CVEID : CVE-2021-41805 Base Score : 8.8 Severity : 高 Issued on : 2021-12-12 Affected Versions ...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM 认证绕过检测器与利用工具 一个针对 CVE-2026-30824 的概念验证检测器与利用工具，该漏洞是 Flowise 中的一个严重认证绕过漏洞，可在无需认证的情况下暴露 NVIDIA NIM API 端点。 漏洞概述 CVE-2026-30824 是 Flowise（ cd cve-2026-30824 安装依赖 pip install -r requirements.txt 或 pip install requests 使用方法 基本漏洞检查 root@kitploit: 检查单个目标是否存在漏洞 python3...

LEAKEY

LEAKEY 🔑 LEAKEY 是一个用于验证渗透测试和红队演练中发现的泄露 API 令牌/密钥的工具。 该脚本对漏洞猎手非常有用，可用于验证和确定泄露凭据的影响。 LEAKEY 使用位于 /.leakey/signatures.json 的基于 JSON 的签名文件。 LEAKEY 的理念是使其高度可定制，并能轻松添加新发现的服务/检查项。 LEAKEY 通过签名文件加载服务/检查列表，如果您想添加更多检查项/服务，只需将其附加到 signatures.json 文件中。 要求： jq 安装： root@kitploit: curl...

CVE-2026-84664

CVE-2026-84664 affects the Jenkins GitLab Plugin version 1.9.16 and earlier. The root cause is an improper use of Stapler's @DataBoundConstructor annotation on the constructor for the global GitLab connection configuration, which allows Stapler to invoke @DataBoundSetter-annotated methods and ove...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API 无限制文件上传导致 RCE 描述 Bludit CMS 3.18.4 之前的版本允许持有有效 API 令牌的已认证攻击者通过 POST /api/files/ 端点上传任意类型和扩展名的文件。uploadFile 函数不执行任何文件扩展名或内容验证，允许上传 PHP 网页木马并以 www-data 权限执行。 受影响版本 存在漏洞： Bludit whoami www-data shell grep BLUDITVERSION /var/www/html/bl-kernel/boot/init.php...

CVE-2026-84803

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in its asset-serving component. The root cause is an incomplete extension blocklist that fails to cover script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf, which resolve to executable media typ...

EUVD-2026-69915

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS 通过不安全的 API 令牌生成实现权限提升 NVD • 安全公告 • CWE-639 概述 StudioCMS ≤ 0.3.0 中的 POST /studiocmsapi/dashboard/api-tokens 端点允许任何已认证用户（至少为 Editor 角色）为任何其他用户 （包括 owner 和 admin 账户）生成 API 令牌。 该端点接受请求体中的 user 参数来指定目标用户 UUID，但从不验证 请求用户是否有权代表该目标用户创建令牌。这是一个典型的对象级授权失效（BOLA）漏洞，可导致完全权限提升。 攻击流程...

PT-2026-84676

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

EUVD-2026-66223

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-82882

Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

EUVD-2026-68773

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909

QuantumNous new-api versions up to 1.0.0-rc.15 are affected by a vulnerability in the Revoked API Token Handler (file /api/usage/token/). Manipulation of an unknown function in this component can lead to session expiration . The attack is remote and requires low privileges , with a low confidenti...