POC-IngressNightmare-CVE-2025-1974

POC of IngressNightmare CVE-2025-1974 Developed from: https://github.com/yoshino-s/CVE-2025-1974 https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Talk is cheap, just look at the code. Detailed can be found at https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Usage 1...

Zerologon-Attack-CVE-2020-1472-POC

CVE-2020-1472 POC 최신 impacket이 필요합니다. GitHub에서 netlogon 구조체가 추가된 버전을 받으세요. 기본적으로 이 도구는 도메인 컨트롤러 계정의 비밀번호를 변경합니다. 물론 DCSync를 수행할 수 있지만, 다른 도메인 컨트롤러와의 통신을 끊어버리므로 주의하세요! 자세한 정보와 원본 연구는 여기에서 확인하세요. 설치 Python 3.6 이상 에서만 작동합니다! OS에 impacket이 이미 설치된 경우 예: Kali, 먼저 기존 설치를 모두 제거하세요. 이후에도 import 오류가 발생하면...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

CVE-2026-105157

A path traversal vulnerability exists in RainyGao DocSys versions up to 2.02.85 . The flaw is located within the DocController.doGetTmp function of the /Doc/doGetTmpFile.do file in the Document Controller component. By manipulating the path/fileName argument, an attacker can perform a path traver...

CVE-2026-105157 RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal

A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitati...

EUVD-2026-92097

A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitati...

CVE-2025-51586-PrestaShop-PoC

CVE-2025-51586 - PrestaShop AdminLogin 이메일 열거 PoC 📌 개요 이 저장소는 CVE-2025-51586 취약점에 대한 윤리적 개념 증명PoC 을 포함하며, PrestaShop 버전 1.7.x — 8.2.2 에 영향을 미칩니다. 이 PoC는 백오피스 비밀번호 재설정 메커니즘AdminLogin 컨트롤러을 통해 관리자 이메일 주소를 열거합니다. 📝 취약점 요약 PrestaShop 1.7부터 8.2.2까지의 AdminLogin 컨트롤러에서 사용자 열거 취약점으로 인해 원격 공격자가 idemployee...

IngressNightmare-RCE-POC

⚠️ Critical RCE in Ingress-NGINX via Configuration Injection CVE-2025-1974 and more This repository contains a proof-of-concept PoC exploit for CVE-2025-1974 , a Critical CVSS 9.8 vulnerability in the Ingress-NGINX controller for Kubernetes. This flaw allows unauthenticated remote code execution...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket 구현으로, 원래 Zhiniang Peng@edwardzpeng과 Xuefeng Li@lxf02942370가 만든 PrintNightmare PoC 입니다. 완전히 패치된 2019 도메인 컨트롤러에서 테스트되었습니다. 악성 DLL을 원격 또는 로컬에서 실행합니다. 설치 익스플로잇을 실행하기 전에 내 버전의 Impacket을 설치해야 합니다. 그러면 문제없습니다. pip3 uninstall impacket git clone...

CVE-2023-40289

CVE-2023-40289 This is an exploit for CVE-2023-40289, a command injection vulnerability in several Baseband Management Controllers BMC by with firmware by ATEN. Examples of affected devices include Aspeed's AST2300 or AST2500, which can be found on Supermicro's X10 and X11 series server systems,...

CVE-2023-5044

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation Firstly, you need deploy Pod & Service: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: - "-text=apple" --- kind:...

CVE-2026-22557

🛡️ CVE-2026-22557 - Ubiquiti UniFi Network Application의 심각한 경로 탐색Path Traversal 취약점 📋 개요 Ubiquiti UniFi Network ApplicationUniFi Controller에 인증되지 않은 심각한 경로 탐색path traversal 취약점CWE-22이 존재합니다. 네트워크 접근 권한 을 가진 공격자는 이 결함을 악용하여 다음을 수행할 수 있습니다: 디렉터리 경계를 탐색../ 기본 운영 체제에서 임의의 파일을 읽고 조작 잠재적으로 시스템 계정에 대한 무단...

CVE-2025-14700-poc

CVE-2025-14700 POC Crafty Controller --login --password --lhost --lport 이 스크립트는 리버스 셸 페이로드를 트리거한 후 netcat을 사용하여 리스너를 설정합니다. 리스너 머신에 netcat이 없으면 작동하지 않습니다...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

Joomla! Component Jstore - 'Controller' Local File Inclusion

A directory traversal vulnerability in Jstore comjstore component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-5286 info: name: Joomla! Component Jstore - 'Controller...

MISP < 2.5.37 - SQL Injection

MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal

DataEase versions up to and including 2.10.3 contain an authentication bypass in io.dataease.auth.filter.TokenFilter. The filter passes the raw, unnormalized request URI to WhitelistUtils.match, which only checks for whitelisted prefixes such as /geo/, /customGeo/, /map/, /oauth2/, and /websocket...

WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...