cve-2024-23897-jenkins_lfi_reproduction

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability CVSS 9.8 CRITICAL — Actively exploited in the wild Overview CVE-2024-23897 is a critical arbitrary file read vulnerability in Jenkins' command-line interface CLI. The Jenkins CLI uses the args4j library for parsing command arguments...

climber

Climber Automated auditing tool to check UNIX/Linux systems misconfigurations which may allow local privilege escalation. Dependencies python = 2.7 python-crypto python-mako python-paramiko Note Climber needs Exscript, a Python module and a template processor for automating network connections ov...

day03-jenkins-23897

Day 3 — Jenkins CLI arbitrary file read CVE-2024-23897 Idea: Jenkins ≤ 2.441 LTS ≤ 2.426.2 expands @/path inside CLI args. Unauthenticated users can make Jenkins read local files and reflect their first lines via the CLI help output. Fixed in 2.442 / 2.426.3. Build → Run root@kitploit: 1 Build...

prowler

Prowler Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network...

CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-42945-POC

CVE-2026-42945 NGINX Rift - HTB-Ready Exploit Standalone exploit for the NGINX heap buffer overflow vulnerability discovered in 2024. This version is optimized for HackTheBox and CTF environments where you can't set up Docker containers. Vulnerability Details CVE-2026-42945 is a critical heap...

Puwr

Contents About Puwr Puwr Usage Port scanning Showcases Disclaimer Future Puwr Easily expand your attack surface on a local network by discovering more hosts, via SSH. Using a machine running a SSH service, Puwr uses a given subnet range to scope out IP's, sending back any successful ping requests...

sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

CVE-2025-57833

CVE-2025-57833 Example Vulnerable application for CVE-2025–57833 Django 4.2 before 4.2.24 Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6 is vulnerable to a SQL injection via Dictionary expansion as kwargs is passed to QuerySet.annotate or QuerySet.alias Currently a work in...

CVE-2026-1281-Ivanti-EPMM-RCE

CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE ⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal. 🎯 Description Complete Proof of Concept PoC for exploiting the CVE-2026-1281 and CVE-2026-1340 vulnerabilities affecting...

CVE-2026-44656

CVE-2026-44656 - Vim Modeline path Option Command Injection Vulnerability English|中文 This repository provides a reproduction environment for CVE-2026-44656. The vulnerability stems from a flaw in Vim's handling of backtick expansion expressions in the path option within modelines. Attackers can...

mapcidr

指定されたサブネット/CIDR範囲に対して複数の操作を実行するユーティリティプログラム。 機能 • インストール • 使い方 • ライブラリ • Discordに参加 mapCIDRは、大量スキャン処理における負荷分散を容易にするために開発されました。ライブラリとしても、独立したCLIツールとしても使用できます。 機能 CIDR展開 サポート デフォルト CIDRスライシング サポート sbh, sbc CIDR/IP集約 サポート a, aa CIDR/IPマッチング サポート match-ip CIDR/IPフィルタリング サポート filter-ip CIDR/IPソート サポート...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

Ivanti EPMM pre-auth RCE Dummy Target A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability CVE-2026-1281 / CVE-2026-1340 for educational and security research purposes. Vulnerability Overview This vulnerability exploits Bash arithmetic expansion behavio...

CVE-2026-33310

CVE-2026-33310 CVE-2026-33310Command Injection via shell Expansion in Parameter Defaults Summary The shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command may be...

CVE-2026-92218

A flaw was found in the release-service-utils component. This vulnerability, known as Server-Side Template Injection, allows an attacker to execute unauthorized code. By manipulating specific input fields, a malicious tenant can inject harmful commands into templates that are processed twice. Thi...

CVE-2024-23897

CVE-2024-23897 Because of a misconfiguration of a default option in the CLI command parser, a attacker can read arbitrary files Summary of the CVE Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a...

CVE-2022-28346

CVE-2022-28346 A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely. Table of Contents CVE-2022-28346 Description Environment Proof of Concept and...

CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability

Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. CVE-2024-23897Arbitrary File Read Vulnerability Jenkins 2.441 and earlier, LTS 2.426.2 and...