CVE-2025-4428

CVE-2025-4427 与 CVE-2025-4428 漏洞扫描器 用于识别易受 CVE-2025-4427 和 CVE-2025-4428 漏洞链攻击的系统的先进检测工具。此安全扫描器帮助识别易受攻击的端点，并展示概念验证型利用。 功能特性 🛡️ 漏洞检测 ：通过签名分析识别易受攻击的系统 💻 命令执行 ：允许通过受控命令执行安全测试漏洞 🔄 重试机制 ：自动重试失败的连接 📄 日志系统 ：详细的日志记录，支持文件和终端输出 🌐 代理支持 ：可配置的代理设置，用于流量检查 🔧 多 Shell 支持 ：兼容 bash 和 sh 环境 📊 输出重定向 ：将结果保存到外部文件 安装 1...

Audit-BlackBox-Web-to-Root

Pentest Lab : Chaîne d'exploitation web et système Drupal to Root 免责声明 本项目是在受控且隔离的实验室环境 中为教育和学术目的而完成的。未针对任何真实基础设施。目标是通过理解攻击机制来学习如何保护系统。 工作环境与目标 场景描述 本项目的目标是进行一次黑盒审计 。这意味着分析在没有任何目标先验知识的情况下开始：未提供任何凭据、技术文档或源代码。 实验室架构 基础设施已在 VMware 上虚拟部署于一个隔离的私有网络（ 仅主机模式 ）中，以避免与外界交互。 攻击机（Kali Linux）： 192.168.78.131...

CVE-2021-3129

CVE-2021-3129 使い方： 注：ローカルにPHP環境が必要です root@kitploit: python3 CVE-2021-3129.py -u http://127.0.0.1:80 （只检测poc） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami （命令执行，默认会遍历所有利用链） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami -chain laravel/rce1 （如检测到可用利用链可直接选择利用）...

NocoBase 2.0.27 - VM Sandbox Escape

Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape Date: 2026-03-26 Exploit Author: Onurcan Genç Vendor Homepage: https://www.nocobase.com/ Software Link: https://github.com/nocobase/nocobase Version: -u -P --cmd "id" python3 exploit.py -t TARGE...

wendor_labs_exploitation

Wendor Vending Machine Exploitation & Security Research Lab T...

CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...

SecLeak

SecLeak Assessment This repository contains the s...

CVE-2025-9191

CVE-2025-9191 — Houzez WordPress Theme PHP Object Injection . The Houzez theme (WordPress) is vulnerable to PHP Object Injection via deserialization in saved-search-item.php for all versions up to 4.1.6. Exploitation requires authenticated access at Subscriber level or higher; a POP chain is not ...

CVE-2025-8871

The Everest Forms Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mimecontenttype function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may ...

PT-2024-39061

Name of the Vulnerable Software and Affected Versions: VICIdial affected versions not specified Description: The issue allows an attacker with authenticated access as an "agent" to execute arbitrary shell commands as the "root" user. This can potentially be chained with other exploits to achieve...

WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...

CVE-2021-31201

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability Recent assessments: architect00 at June 09, 2021 6:55am UTC reported: This vulnerability is abused in an exploitation chain. According to the Microsoft advisory it is abused with Adobe Acrobat CVE-2021-28550. gwillcox-...