WordPress Image Hover Ultimate - Unauthenticated Settings Update

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate versions = 9.6.1 WordPress plugin. id: CVE-2021-36888 info: name: WordPress Image Hover Ultimate - Unauthenticated Settings Update author: riteshs4hu severity:...

WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting

WordPress defa-online-image-protector 3.3 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution RCE Exploit Dieses Skript nutzt eine Remote-Code-Execution-Schwachstelle in SPIP Version 4.2.8 über den porteplumeprevisu-Endpunkt aus. Die Schwachstelle ermöglicht es nicht authentifizierten Angreifern, PHP-Code durch die Vorschau-Wiedergabe...

kube-alien

Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...

dvwassl

SSL-fähige Damn Vulnerable Web App Führen Sie eine SSL-fähige Damn Vulnerable Web App aus. Warum? Sie möchten möglicherweise Webangriffserkennungen über SSL testen. Image erstellen root@kitploit: docker build -t dvwassl:latest . Container ausführen root@kitploit: docker run -d -p 443:443...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Prova de conceito para CVE-2020-11819 e CVE-2020-15946. Testado no Rukovoditel 2.4.x, 2.5.x e 2.6.1 Descrição: Este exploit possui dois modos de execução, utilizando a vulnerabilidade de fixação de sessão CVE-2020-15946 ou usando as credenciais de acesso de qualquer conta em...

node-vulnerable

node-vulnerable Questo repository è un target demo sintetico per Endor Labs EXPOSURE. Lo stato attuale è deliberatamente sfruttabile. EXPOSURE riporterà un verdetto di sfruttabilità contro di esso. CVE tracciati: CVE-2018-21268 — iniezione di comandi traceroute tramite l'argomento host. Sfruttabi...

exif-gps-tracer

exif-gps-tracer Ein Python-Skript, mit dem Sie GeoLocation-Daten aus Ihren in einem Datensatz gespeicherten Bilddateien extrahieren können. Es erzeugt auch eine Ausgabe in einer CSV-Datei und in einer HTML-Google-Maps-Datei. Voraussetzungen Um dieses Skript reibungslos auszuführen, 1 Sie sollten...

Chaya

Chaya Diritto alla Privacy Chaya protegge la tua privacy tramite steganografia, crittografia e compressione. Crittografa efficacemente i tuoi payload usando la crittografia AES-256-GCM , li incorpora usando la tecnica di steganografia LSB-LPS nelle immagini e li comprime usando FLIF per eludere i...

CVE-2026-13215 Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

The Zephyr ext2 filesystem driver fails to validate the slogblocksize field of the on-disk superblock when mounting a filesystem. ext2verifydisksuperblock in subsys/fs/ext2/ext2impl.c checks the magic number, revision, inode size and group counts, but never bounds slogblocksize. On a successful...

kali-nethunter-installer

Kali NetHunter Installer Dieser Kali NetHunter-Installer ist im Grunde nur eine ZIP-Datei, die von build.py aus dem hier enthaltenen Ordnerlayout erzeugt wird. Befolge die folgenden Anweisungen, um die Kali-NetHunter-Installer-ZIP zu erstellen. Alles, was du tun musst, ist, sie über Recovery/TWRP...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Docker Registry V2 Schema 1 Avvelenamento delle Immagini Codice del Programma Python Flask + Shell root@kitploit: dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers':...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – SVG इमेज अपलोड के माध्यम से XXE प्रोग्राम कोड Python Flask + XML पार्सर root@kitploit: xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST' def uploadsvg:...

img-payloads

⚠️ Disclaimer : Il contenuto di questo repository è fornito esclusivamente a scopo educativo e informativo; gli autori non si assumono alcuna responsabilità per un uso improprio. Assicurati di ottenere la dovuta autorizzazione prima dell'uso, agisci in modo responsabile a tuo rischio e pericolo e...

Volumiser

Volumiser Introdução O Volumiser é uma ferramenta de linha de comando e uma GUI de console interativa para listar, navegar e extrair arquivos de formatos comuns de imagem de disco rígido de máquinas virtuais. A ferramenta foi escrita para combater um problema recorrente em que imagens de disco...

php-jpeg-injector

php-jpeg-injector Injects php payloads into jpeg images. Related to this post. Use Case You have a web application that runs a jpeg image through PHP's GD graphics library. Description This script injects PHP code into a specified jpeg image. The web application will execute the payload if it...

CVE-2026-13001

CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critico | Caricamento arbitrario di file non autenticato che porta all'esecuzione remota di codice Panoramica Vulnerabilità critica nel plugin WordPress Podlove Podcast Publisher versioni fino alla 4.5.1 inclusa che consente ad aggressori non...

CVE-2021-40444-docx-Generate

CVE-2021-40444 docx-Generierung docx-Generierung zur Ausnutzung von CVE-2021-40444 Microsoft Office Word Remote Code Execution 1. Erstelle eine leere .docx-Datei. 2. Füge ein "Bitmap Image"-Objekt im Menü "Einfügen/Objekt" hinzu. 3. Speichern und docx entpacken. 4. Ändere...