CVE-2026-51788

Aviso de Seguridad: CVE-2026-51788 Vulnerabilidad de Denegación de Servicio DoS en cleverangeauth v0.1.10 ID de CVE: CVE-2026-51788 Estado: Asignado Fecha de descubrimiento: 2026-04-27 Investigador: Aykhan Isgandarli Gravedad: Alta CVSS v3.1: 7.5 Vector CVSS:...

lnkbomb

Lnkbomb Lnkbomb 用于向不安全的文件共享上传恶意快捷方式文件。该漏洞存在的原因在于 Windows 会查找与快捷方式文件关联的图标文件。该图标文件可以被指向渗透测试人员运行 Responder 或 smbserver 的机器，从而收集 NTLMv1 或 NTLMv2 哈希（具体取决于受害主机的配置）。测试人员随后可以尝试使用 Hashcat 等工具离线破解收集到的哈希，或将其中继到 ntlmrelayx 等工具进行进一步利用。 载荷文件直接上传到测试人员在命令行中指定的不安全文件共享。测试人员还需提供其 IP 地址，该地址会被写入载荷中。 2.0...

EGESPLOIT

EGESPLOIT EGESPLOIT 是一个用于恶意软件开发的高语言库，它具有一些用于 meterpreter 集成的独特功能。 文档 root@kitploit: CalculateChecksumx : 函数计算用于反向 HTTP/HTTPS meterpreter 连接的 x 位 8 位校验和，并以字符串形式返回计算出的校验和。 MeterpreterConType, Address : 函数启动一个 meterpreter 连接，接受两个参数：连接类型（HTTP/HTTPS/TCP）和地址（127.0.0.1:4444），函数返回一个字符串用于错误处理。 Persistence...

sshLooter

DON'T USE THIS There's a C version which is much better sshLooterC sshLooter Script to steal passwords from ssh. Install root@kitploit: git clone https://github.com/mthbernardes/sshLooter.git cd sshLooter Configuration root@kitploit: Edit the script on install.sh, and add your telegram bot api, a...

GitLab - Account Takeover via Password Reset

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

bash-CVE-2017-17562

bash-CVE-2017-17562 一个用于CVE-2017-17562的BashPoC实现。 需要curl来构造HTTP请求。 基于Metasploit和@fssecur3的实现。 参数 以下参数必须设置，因为它们是侦察和载荷发送所必需的： root@kitploit: $1: 被攻击远程脆弱主机的IP/主机名 $2: 远程机器Web服务器的端口 $4: 发送给脆弱主机的精心构造的载荷路径 可选地，以下参数也可以设置： root@kitploit: $3: Web服务器是否运行在TLS/SSL隧道下。默认为否 $5:...

CVE-2026-85208

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-85207

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-85208 itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-85208

itsourcecode Online Medicine Delivery System 1.0 is affected by an unrestricted file upload vulnerability in the Order Management Controller , specifically the doInsert function within /rider/orders/controller.php?action=add. Manipulating the image argument allows an unauthenticated remote attack...

EUVD-2026-70700

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-85207

A reflected cross-site scripting (XSS) vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0 , specifically in an unknown function of the file /index.php?q=orderdetails . Manipulation of the location argument enables an attacker to inject arbitrary scripts. The attack i...

CVE-2026-85207 itsourcecode Online Medicine Delivery System index.php cross site scripting

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

EUVD-2026-70674

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated...

CVE-2026-85186

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to...

EUVD-2026-70648

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID lead...

CVE-2026-85187

itsourcecode Online Medicine Delivery System 1.0 is affected by an SQL injection vulnerability in the Order::pupdate function within the file /rider/orders/controller.php?action=edit&actions=confirm (component: Order Status Update). The vulnerability is triggered by manipulating the ID argument, ...

CVE-2026-85186

itsourcecode Online Medicine Delivery System 1.0 is affected by an unrestricted file upload vulnerability in the Customer Controller component, specifically the doupdateimage function in /customer/controller.php?action=photos. An attacker can manipulate the photo argument to upload arbitrary file...

CVE-2026-85186 itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. Infraestructura C2: servidores resilientes y redundantes El análisis de memoria con Process Hacker revela una lista completa de dominios utilizados por el Dropper GCleaner para la comunicación C2. Estos dominios están alojados en varias plataformas Scaleway, Render, Replit, etc., lo que indica...