CVE-1999-0678

CVE-1999-0678：检测与修复项目 作者： Pham Huu Minh 日期： 2025年12月 项目概述 本项目展示了漏洞评估的完整生命周期，特别针对 Apache Web 服务器上的遗留目录遍历漏洞 CVE-1999-0678 。目标是模拟攻击、使用 IDS 检测并永久修复该安全漏洞。 技术栈 攻击者： Kali Linux Curl, Firefox, GVM 受害者： Ubuntu Server Apache2, Snort IDS 工具： Greenbone Vulnerability Manager, Snort, Iptables 阶段 1：发现与利用...

sccm_sql_backdoor

sccmsqlbackdoor 一个概念验证工具，用于将受控后门植入管理点（Management Point）存储过程，从而通过合法的 MP HTTP 服务实现间接 SQL 执行。 安装 你可以通过克隆仓库并安装依赖项来安装。 root@kitploit: $ git clone --recurse-submodules https://github.com/synacktiv/sccmsqlbackdoor $ cd sccmsqlbackdoor $ python3 -m venv .venv && source .venv/bin/activate $ pip install -e...

CVE-2019-20933

CVE-2019-20933 InfluxDB 1.7.6 से पहले के संस्करणों में services/httpd/handler.go के authenticate फ़ंक्शन में एक प्रमाणीकरण बाइपास भेद्यता है, क्योंकि JWT टोकन में SharedSecret अर्थात साझा गुप्त कुंजी खाली हो सकता है। अधिक विवरण के लिए https://nvd.nist.gov/vuln/detail/CVE-2019-20933 देखें PoC यह P...

CVE-2025-32375

漏洞版本设置 启动漏洞容器： root@kitploit: docker compose up 创建一个监听器（例如 ncat）： root@kitploit: ncat -klnv 1337 运行漏洞利用程序： root@kitploit: python3 exploit.py 如果一切正常，你应该会在 ncat 窗口中收到一个 HTTP 请求，其中包含 OS 命令（默认情况下为 id）的执行结果。 致谢 漏洞发现者：SeaW1nd 基于 VickyTheViking 的测试环境设置...

CVE-2017-12635_36

Lab7-CVE-2017-12635-12636 I. सिस्टम विश्लेषण अटैक सतह की पहचान वातावरण में क्या चल रहा है, इससे शुरुआत करते हुए, मैं सभी सक्रिय कंटेनरों को सूचीबद्ध करता हूँ: docker ps पीड़ित केवल एक पोर्ट एक्सपोज़ करता है:5984 ⇒ मैं अधिक जानकारी के लिए सीधे उस पर curl करता हूँ: curl -i http://192.168.3.137:5984...

cve-2015-3306

immagine docker cve-2015-3306 hackarada/cve-2015-3306 Destinato all'uso personale root@kitploit: docker build -t hackarada/cve-2015-3306 docker run --rm -it -p 21:21 -p 80:80 hackarada/cve-2015-3306...

CVE-2025-31161

CVE-2025-31161 Escrevi um exploit em Go para o CVE-2025-31161 que afeta o crushFTP. Uso root@kitploit: ./exploit -target http://localhost:8085 -user crushadmin -action create-admin -new-admin-user username -new-admin-pass pass...

CVE-2026-81032

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-81032

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-81032 NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

EUVD-2026-66608

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

EUVD-2026-63168

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

CVE-2026-8619

The HTTP service in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 crashes via NULL pointer dereference when an adjacent-network attacker sends a specially crafted HTTP request, temporarily disabling the web management interface. CVSS 4.0 base score is 7.1 (HIGH). TP-Li...

CVE-2026-8619 Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send ...

CVE-2026-69119

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

CVE-2026-48135 HTTP service can incorrectly process malformed HTTP requests

A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation...

ctf-writeups-Doli1

🛡️ Doli 1 — CTF Writeup VulnHub VAPT Report For...

CVE-2026-34124

TP-Link Tapo C520WS v2.6 contains a DoS in HTTP path parsing: the raw request path length is restricted but path expansion during normalization is not accounted for, enabling adjacent-network attackers to craft requests that may cause buffer overflow and memory corruption, potentially interruptin...

CVE-2026-34124 Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent...

EUVD-2025-208321

A denial-of-service DoS vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610...