CVE-2023-46818

CVE-2023-46818 - ISPConfig PHP コード実行 | エクスプロイト ISPConfig における高危険度リモートコード実行 PoC 実装 概要 ISPConfig バージョン 3.2.11 以下は、/admin/languageedit.php エンドポイントの records パラメータを介した、認証済み PHP コードインジェクションの脆弱性に対して脆弱です。 🛠 技術解説 このエンドポイントはユーザー入力を適切に検証しません。有効な認証情報を持つ攻撃者は、言語編集機能に対して特別に細工されたリクエストを送信し、サーバー上のファイル（一般的には...

CVE-2026-86180 code-projects Task Management System In PHP Login index.php sql injection

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

EUVD-2026-72077

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

CVE-2026-86180

A SQL injection vulnerability affects the Login component of code-projects Task Management System In PHP 1.0 , specifically through manipulation of the email parameter in /index.php. The attack is remote and requires no authentication or user interaction , with a CVSS 3.1 score of 7.3 (HIGH) . Th...

CVE-2024-21532-PoC-ggit

CVE-2024-21532 ggit의 명령 주입 취약점 ggit은 자신을 다음과 같이 설명합니다: root@kitploit: Local promise-returning git command wrappers 리소스: 프로젝트 GitHub 소스 코드: https://github.com/bahmutov/ggit 프로젝트 npm 패키지: https://www.npmjs.com/package/ggit 이 취약점에 대한 분석 기사:...

IngressNightterror

IngressNightterror CVE-2025-1974 개요 이 저장소는 IngressNightmare 취약점에 대한 제 연구입니다. 취약한 Ingress 배포 파일, 익스플로잇 자체, 공유 객체 페이로드를 포함하고 있습니다. CVE CVE 인덱스 목록: CVE-2025-1974 - 근본 취약점 CVE-2025-24514 - auth-url 어노테이션 주입 CVE-2025-1097 - auth-tls-match-cn 어노테이션 주입 CVE-2025-1098 - 이미지 UID 남용 참고 자료 몇 가지 참고 자료: 원본...

coolify-cve-2025-66209-66213

Coolify 보안 권고 - CVE-2025-66209 CVE-2025-66213 보고자: 0xrakan 공급업체: coollabsio/coolify 영향받는 버전: v4.0.0-beta.451 수정된 버전: v4.0.0-beta.451 심각도: 치명적 CVSS 9.4 개요 Coolify에서 다섯 가지 치명적인 인증된 명령 삽입 취약점이 발견되었습니다. 이 취약점은 애플리케이션/서비스 관리 권한을 가진 인증된 사용자가 관리 서버에서 루트 권한으로 임의 명령을 실행할 수 있게 하여, 컨테이너 탈출 및 호스트 시스템 전체 손상으로...

pyrocms-ssti-fix

🛡️ PyroCMS SSTI 修正 CVE-2023-29689 向けドロップインセキュリティ修正 - PyroCMS 3.9 におけるリモートコード実行につながるサーバーサイドテンプレートインジェクション。 問題点 PyroCMS では、管理者ユーザーがデータベースに保存されたテンプレートを編集できます。サンドボックス化されていない場合、管理者アクセス権を持つ攻撃者は悪意のある Twig コードを注入できます。 root@kitploit: 'id'|map'system'|join...

CVE-2026-72898-safe-detection

CVE-2026-72898-safe-detection Simple script to achieve safe and non-destructive active detection of CVE-2026-72898 SQLi in Metabase It attempts to determine if a Metabase instance is vulnerable to the SQL injection vulnerability in the password reset endpoint. The script is designed to be safe an...

agentic-dm-gateway

Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...

CVE-2026-34910-PoC

CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read Unauthenticated Command Injection RCE CVE-2026-34910 + Path Traversal Arbitrary File Read CVE-2026-34909 in UniFi OS Server. CVSS 10.0 Critical each · CISA KEV listed · actively exploited by a Mirai-derived botnet azsxd...

CVE-2026-47117-openmed-rce

CVE-2026-47117: OpenMed PII 모델 로딩을 통한 인증되지 않은 원격 코드 실행 심각도: 치명적Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 CNA인 VulnCheck가 배정 벡터 v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 벡터 v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 영향 범위: OpenMed 1.5.2 수정 버전: 1.5.2 CWE: CWE-94 코드 생...

CVE-2026-86172 DefaultFuction CRM delete.php sql injection

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

CVE-2026-86172

CVE-2026-86172 is an SQL injection vulnerability in DefaultFuction CRM version 1.0.0 , located in the file /modules/customers/delete.php . An attacker can manipulate the ID argument to inject SQL commands, enabling remote exploitation with low privileges required and no user interaction. The CVSS...

EUVD-2026-72075

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

CVE-2026-86172 DefaultFuction CRM delete.php sql injection

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

onecli

팀을 위해 만들어진 에이전트 하네스. 기업을 위한 프로 어시스턴트. 모든 직원에게 안전하고 샌드박스 처리된 개인 에이전트를 제공하세요. 웹사이트 · 문서 · Discord 빠른 시작 클라우드 호스팅: onecli.sh 자체 호스팅 root@kitploit: git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setup http://localhost:10254 열기 OneCLI v2란 무엇인가요? OneCLI는 AI 에이전트를 팀 단위...

omapi-cve-2015-6606-exploit

Simple Exploit for Verification of CVE-2015-6606 This is a simple exploit to verify a code injection vulnerability that exists in the SEEK smartcard service versions 3.1.0 and below CVE-2015-6606, Google internal bug ANDROID-22301786. The vulnerability allows specially crafted Android application...

CVE-2026-86171

A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 취약점이 발견되어 Anteeo WMS - v4.7.31 에서 테스트되었습니다. 이 취약점은 공격자가 username 파라미터 내에 SQL 명령을 조작하여 기본 데이터베이스의 데이터를 유출할 수 있게 합니다. 영향을 받는 ANTEEO B2B WMS 버전은 v.4.7.x부터 v.4.7.34 미만입니다. 사용법 1. git clone [email protected]:AndreaF17/PoC-CVE-2024-44349.git 2. cd PoC-CVE-2024-44349 3. python3 -...