rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources...

CVE-2025-34077

CVE-2025-34077 Secuestro de sesión de administrador no autenticado - Plugin Pie Register ≤ 3.7.1.4 📌 Descripción Este exploit apunta a una vulnerabilidad en el plugin Pie Register de WordPress versiones ≤ 3.7.1.4, permitiendo el secuestro de sesión de administrador no autenticado. 🛡️ Esta...

CVE-2026-46587

Inyección de cabecera CCB en camel-couchbase — Reproducción CVE-2026-46587 Este proyecto demuestra una inyección en las cabeceras del mensaje en el componente camel-couchbase de Apache Camel, registrada como CVE-2026-46587. El componente lee varias cabeceras del Exchange para controlar su...

CVE-2019-8656

CVE-2019-8656 CVE-2019-8656 Omisión de GateKeeper https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypass...

fastjson-1.2.61-RCE

fastjson-1.2.61-RCE Nota： En el archivo https://github.com/alibaba/fastjson/blob/master/src/main/java/com/alibaba/fastjson/parser/ParserConfig.java, el equipo oficial añadió 0x7bddd363ad3998c6L es decir, 1.2.61 8925522461579647174 0x7bddd363ad3998c6L...

fastjson-1.2.60-rce

Vulnerabilidad de deserialización en Fastjson = 1.2.60 Bypass de la lista de bloqueo de autoType con 2 gadgets JNDIConfiguration, OracleManagedConnectionFactory Gadgets root@kitploit: 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。...

e-cology

Ejecución remota de código en el componente Beanshell de 泛微 e-cology OA Windows Linux Ps root@kitploit: 检测目标系统os.name（因为目标系统是windows的话，执行set等命令，需要手动敲cmd.exe /c set） 使用Unicode绕过exec过滤，部分站点 Payload root@kitploit: bsh.script=exec'whoami'; unicode bypass bsh.script=\u0065\u0078\u0065\u0063"whoami";...

cve-2020-13933

cve-2020-13933 cve-2020-13933 vulnerabilidad de omisión de autenticación de Apache Shiro Esta reproducción es muy simple, primero configurar el entorno con IDEA+shiro Referencia: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Luego ejecutar, acceder, capturar el tráfico...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Bypass de autenticación simple poc de bypass de autenticación; si quieres acceder a través del navegador, no olvides cambiar la variable USERAGENT en el script según lo que se muestre en tu navegador para que funcione. usa un editor de cookies para reemplazar el valor sid y u...

gitlab-SSRF-redis-RCE

gitlab-SSRF+CRLF-Redis-RCE GitLab 11.4.7 SSRF + inyección CRLF combinado con ejecución remota de código en Redis 0x00 Entorno de vulnerabilidad root@kitploit: root@kali: cd gitlab-docker root@kali: docker-compose up -d root@kali: docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES...

rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...

rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions

A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...

mimikat_ssp

mimikatssp captura de contraseñas de Windows evadiendo antivirus...

CVE-2026-20896

CVE-2026-20896 La imagen oficial de Docker de Gitea hasta la 1.26.2 inclusive incluye REVERSEPROXYTRUSTEDPROXIES = en su configuración por defecto. Si activas el inicio de sesión mediante proxy inverso, ese comodín significa que cada IP de origen se trata como un proxy de confianza, por lo que...

CVE-2025-10184_PoC

APK Build for CVE‑2025‑10184 PoC This is an APK Build for a PoC of CVE‑2025‑10184 The vulnerability exists in com..providers.telephony, allowing arbitrary applications to read SMS messages without SMS read permission Source Code The source code and more details can be found in Rapid7's article:...