cve-2025-24514

🔥 CVE-2025-24514 远程漏洞检测 PoC 该脚本是一个基于 Python 的 PoC，用于远程检测 CVE-2025-24514 漏洞（通过 ingress-nginx 的 auth-url 注入操纵 NGINX 配置并可能导致 RCE）。 🧠 漏洞概述 CVE-2025-24514 是 Kubernetes Ingress Controller 中的 ingress-nginx 通过 nginx.ingress.kubernetes.io/auth-url 注解进行 NGINX 配置意外注入 的漏洞。 若包含恶意路径/;errorlog /dev/stdout;，则...

CVE-2021-44077

CVE-2021-44077 CVE-2021-44077 の概念実証エクスプロイト: ManageEngine ServiceDesk Plus msiexec.exe pip install で requirements ファイルをインストールするか、requests パッケージがインストールされていることを確認してください。 リバースシェルを取得しようとする場合は、最初にリスナーを実行してください。例: root@kitploit: nc -l 4444 次に、url と exe 引数を指定してエクスプロイトスクリプトを実行します。例: root@kitploit: python...

EUVD-2026-80570

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970

CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel NVMe Target (nvmet) authentication subsystem. During Submission Queue (SQ) teardown, nvmet_auth_sq_free() uses cancel_delayed_work() to stop auth_expired_work, but if the work has already started, cancellation does not wait for ...

CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

wp2shell-checker

root@kitploit: \ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress 批量 API 失同步检测器 用于 WordPress 核心 REST 批量 API 预认证 RCE 的检测器 由 0xjessie21 创建 — Cybersecurity ILCS 概述...

CVE-2024-4358

CVE-2024-4358 / CVE-2024-1800 针对 CVE-2024-4358/CVE-2024-1800 的 Telerik Report Server 反序列化和认证绕过利用链 技术分析 漏洞的根因分析可在我的博客上找到 用法 root@kitploit: python CVE-2024-4358.py --target http://192.168.253.128:83 -c "whoami" ^^ Progress Telerik Report Server 预认证 RCE CVE-2024-4358/CVE-2024-1800 || Sina Kheirkhah...

CVE-2026-14917

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

CVE-2026-14917

CVE-2026-14917 is a SAML authentication bypass in the Kong API Gateway Enterprise SAML plugin. When the validate_assertion_signature option is explicitly set to false (it is enabled by default ), the plugin extracts the SAML identity from an unsigned assertion without verifying a valid cryptograp...

copyfail-rs

copyfail-rs 针对 CVE-2026-31431（CopyFail）的多向量 PoC + 配套检测工具。 包含一个其他公开 PoC 均未提供的全新 PAM 认证绕过向量。 检测模式可捕获 AIDE / Wazuh / OSSEC / Tripwire 在结构上无法发现的问题。 单一静态二进制文件。约 108 KB。nostd musl。 演示 root@kitploit: noot@host:$ ./copyfail-rs --mode exploit sudo password for noot: root@host: id uid=0root gid=0root...

CTF-2021

CTF-2021 注意事項 このCTFは認証にデータベースを使用していません。さらに、以下の理由により、このCTFでは静的なトークンを生成しています。 1. ユーザーがこのCTFを別の方法で解く可能性を最小限にするため 2. ユーザーがウェブページやトークンを変更・バイパスしてヒントを見逃す可能性を最小限にするため 3. トラフィックを減らすため 4. このCTFを解くユーザーにとっての信頼性を高めるため LPEパートではUbuntu 20.04を推奨します。 これをクローンした場合、このREADME.mdファイルにはヒントが含まれているため、削除してください。...

CVE-2026-84439

Apache ZooKeeper is affected by an audit log injection vulnerability in zookeeper_audit.log. When audit logging is enabled (zookeeper.audit.enable=true), two attack vectors exist: an unauthenticated attacker can embed tab characters (\t) in a digest authentication username, and an authenticated c...

CVE-2026-86462

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-86466

The Authentik OAuth path in the Apache Airflow FAB auth manager fails to validate the issuer and audience claims of the accepted id_token. An attacker holding a valid token minted by the same Authentik instance for a different client application can present it to Airflow and be authenticated as t...

EUVD-2026-80327

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-86462

Apache Airflow FAB provider contains a session-invalidation gap in the Admin user-edit PATCH endpoint . When a user's password is changed through this path, existing database-backed sessions are not invalidated because the PATCH handler never calls the session-invalidation helper. An attacker alr...

EUVD-2026-80320

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2024-4040

CVE-2024-4040 のエクスプロイトコード 概要 このエクスプロイトコードはCVE-2024-4040脆弱性を対象とし、"sessions.obj"ファイルに保存されたトークンを読み取り検証することで、ユーザーアカウントへの不正アクセスを可能にします。トークンが有効であれば、ハッカーは対象アカウントに侵入できます。CVE-2023-43177のような類似脆弱性を悪用する他の方法とは異なり、このスクリプトにはバックドアJARの作成およびアップロード機能は含まれていません（この部分は自分で開発することができます）。 例 python3 exploit.py -u...