silverboxcc

Malware de Android con ingeniería inversa llamado Red Alert V2.0. En el momento del análisis, ya no había servidores C2 en funcionamiento, por lo que no pudimos observar ningún tráfico entre el malware y el servidor C2. Así que descubrimos el protocolo C2 y escribimos este panel de control. El...

CPLDCOMTrigger

CPLDCOMTrigger Descripción Un script Python que depende de los scripts de Impacket para activar la carga de un archivo .cpl en memoria utilizando un objeto DCOM. La ruta del archivo CPL ya debe estar agregada al registro. El script utiliza la función Open en la interfaz IOpenControlPanel para...

CPLDCOMTrigger

CPLDCOMTrigger Descripción Un script de Python que depende de los scripts de Impacket para desencadenar la carga de un archivo .cpl en la memoria utilizando un objeto DCOM. La ruta del archivo CPL ya debe estar añadida al registro. El script utiliza la función Open en la interfaz IOpenControlPane...

SecurityNotFound

404 Página No Encontrada Webshell 📼 ¡Clóname! Clona o descarga el proyecto: root@kitploit: git clone --depth=1 https://github.com/CosasDePuma/SecurityNotFound.git 📦 "Instalación" El archivo src/404.php debe ubicarse en el servidor objetivo y debe tener la capacidad de ejecutar archivos .php. Aquí...

cyberpanel

🛠️ CyberPanel Web Hosting Control Panel powered by OpenLiteSpeed, designed to simplify hosting management. 🔧 Features & Services 🔐 Different User Access Levels via ACLs. 🌌 Auto SSL for secure websites. 💻 FTP Server for file transfers. 🕒 Light-weight DNS Server PowerDNS. 🔐 phpMyAdmin to manage...

CVE-2023-41362_MyBB_ACP_RCE

CVE-2023-41362 - RCE en el ACP de MyBB Exploit para CVE-2023-41362 Entrada de blog: https://blog.sorcery.ie/posts/mybbacprce...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

cve-2020-0688

cve-2020-0688 cve-2020-0688 使用具有电子邮件地址的用户登录，该权限无需担忧。 从页面源代码中获取 VIEWSTATEGENERATOR 获取 ASP.NETSessionId cookie 的值作为 viewstateuserkey 的值 在此下载 YSO root@kitploit: ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "nslookup teasdas.myburpcollab.net" --validationalg="SHA1"...

AhMyth-Android-RAT

AhMyth Android Rat Beta Version Repositorio original https://github.com/AhMyth/AhMyth-Android-RAT.git El repositorio actual corrige problemas comunes para su instalación en debian 10, también recopila pull requests aún no aprobado e incorpora nuevas funcionalidades...

CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-84793

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-84793

Craft CMS versions from 5.0.0-RC1 through before 5.10.11 are affected by a stored cross-site scripting (XSS) vulnerability in the site name field . The root cause is a failure to sanitize input in that field, allowing privileged administrators to inject arbitrary JavaScript payloads that execute ...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84792

Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...

EUVD-2026-69905

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

PT-2026-84674

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...