cisco-SNMP-enumeration

Cisc0wn - Cisco SNMP 脚本 Cisco SNMP 枚举、暴力破解、配置下载和密码破解脚本。 针对 Cisco IOS 交换机和路由器设计并测试。 由 NCC Group Plc 以开源方式发布 - http://www.nccgroup.com/ 由 Daniel Compton 开发，daniel dot compton at nccgroup dot com 由 Tom Watson 修复并更新，tom dot watson at nccgroup dot com 由 Darren McDonald 做小幅提交，darren dot mcdonald at...

behat-config-leaks

徽章 许可证 MIT 安装...

EUVD-2026-81098

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82430

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82421

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2025-8110

Gogs RCE 漏洞利用 CVE-2025-8110 针对 CVE-2025-8110 的概念验证 — 通过符号链接绕过和 sshCommand 注入实现 Gogs 远程代码执行。 描述 该漏洞利用 Gogs API 中的符号链接绕过，覆盖 .git/config 并注入恶意 sshCommand，从而执行反弹 Shell。 需求 Python 3.12+ 已安装 Git 有效的 Gogs 凭据 Gogs API 令牌 安装 root@kitploit: git clone https://github.com/X4BROZER/CVE-2025-8110.git cd...

CVE-2025-60787-POC

CVE-2025-60787 - motionEye 认证后的远程代码执行 通过未净化的 motion 配置参数在 motionEye = 0.43.1b4 中实现认证后的远程代码执行 作者：d3vn0mi 漏洞概述...

ai-ide-config-guard

valtik-ai-ide-config-guard 扫描仓库中的 AI-IDE 配置文件，这些文件可能在 Claude Code、Cursor、Windsurf、Continue 或任何 VS Code 分支中打开仓库时触发 RCE、凭据窃取或开发者机器的持久化攻击。 响应于 2026 年 4 月 AI-IDE 披露浪潮而构建： CVE-2025-59536 / CVE-2026-21852 — Claude Code settings.json 中的 SessionStart / PreToolUse / PostToolUse / UserPromptSubmit...

EUVD-2026-80805

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields...

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

GHSA-465G-FH3V-9JW4 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

CVE-2025-8110-Silentium-HTB

CVE-2025-8110 — PoC de RCE en Gogs Silentium / HackTheBox Aviso: Esta herramienta está destinada exclusivamente a fines educativos y pruebas de penetración autorizadas. Úsela solo contra sistemas en los que tenga permiso explícito para probar. Esta es una versión modificada de...

CVE-2026-92917

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

BIT-MONGODB-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

BIT-MONGODB-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

dotclaude-security

dotclaude-security 扫描仓库本地的 .claude/ 配置 —— settings.json 钩子、MCP 服务器定义、env 块、permissions.allow —— 找出那些在 git clone 并打开不受信任仓库后，立即在 Claude Code 中触发的 RCE 和 API 密钥泄露 陷阱。它会指向 精确的危险行号 ，让你在信任之前先阅读。它只读取，从不执行发现的内容。 ⚡ 一行命令运行，无需安装，数据不会离开你的机器： root@kitploit: npx dotclaude-security --dir ./some-cloned-repo 🤝...

CVE-2026-31431-mitigation-suite

AFALG Defense Framework A kernel-runtime defense framework for the Linux AFALG Address Family Algorithm, family 38 subsystem. Built for Security Operations Centers running enterprise Linux fleets where Zero Trust must extend into the kernel, not stop at the network edge. Why AFALG matters to a SO...