CVE-2022-26629

Bypass della schermata di blocco CVE-2022-26629 Prodotti interessati SoroushPlus+ Messenger 1.0.30 Tipo di vulnerabilità Controllo degli accessi improprio Impatto Bypass della schermata di blocco Sommario La gestione impropria di permessi e privilegi insufficienti consente a un attaccante di...

goGetBucket

goGetBucket - AWS S3 बकेट की खोज परिवर्तनों और क्रमपरिवर्तनों के माध्यम से चेतावनी: कोड भयानक है क्योंकि मैंने इसे केवल व्यक्तिगत उपयोग के लिए उपयोग किया है। जब मुझे समय मिलेगा, मैं इसे कम भयानक और तेज़ बनाऊंगा। जब किसी डोमेन पर रेकॉन करते हैं - यह समझना बहुत महत्वपूर्ण है कि उनके पास कौन से एसेट...

CVE-2026-77507

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

Tomcat-CVE-2017-12615

ثغرة الكتابة التعسفية للملفات في Tomcat من خلال طريقة PUT CVE-2017-12615 中文版本Chinese version إصدار Tomcat: 8.5.19 إعداد البيئة root@kitploit: docker-compose build docker-compose up -d بعد تشغيل الأوامر أعلاه بنجاح، سترى صفحة المثال الخاصة بـ Tomcat عند زيارة الموقع http://your-ip:8080. الأساس...

redexer

redexer Redexer è uno strumento di reingegnerizzazione che manipola i binari delle app Android. Questo strumento è in grado di analizzare un file DEX in una struttura dati in memoria; di dedurre con quali parametri l'app utilizza determinati permessi chiamiamo questa funzionalità RefineDroid; di...

CVE-2024-34223

Human Resource Management System Project in PHP and MySQL Free Source Code Einreicher: Kha Do Schwachstelle Unsichere Berechtigung Beschreibung Die Schwachstelle „Unsichere Berechtigung" in /hrm/leaverequest.php im SourceCodester Human Resource Management System 1.0 ermöglicht es Angreifern,...

CVE-2023-36664-Ghostscript-command-injection

PoC della vulnerabilità di command injection in Ghostscript CVE-2023-36664 La vulnerabilità divulgata in Ghostscript precedente alla versione 10.01.2 consente l'esecuzione di codice punteggio CVSS 9.8. Ufficiale descrizione della vulnerabilità: Artifex Ghostscript fino alla 10.01.2 gestisce in mo...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Tipo di vulnerabilità: Controllo di accesso non corretto Descrizione: Un problema scoperto in Obsidian Canvas 1.1.9 consente a utenti malintenzionati remoti di inviare notifiche desktop, registrare l'audio dell'utente e altri impatti non...

CVE-2026-77507

Weblate , a web-based continuous localization platform, is affected by an information disclosure vulnerability in its object-scoped RSS feeds prior to version 2026.8 . The root cause is that these feeds fail to enforce the permission checks applied elsewhere, allowing unauthorized users to read c...

smbeagle

root@kitploit: / \ / // / / / // / / / / / ///\ / / / / / / / / / / / / / / // / / / / , / / / // // / / / / // // / // ,// ///||////,// ///, / PRESENTS // SMBeagle SMBeagle è uno strumento di audit delle condivisioni file SMB multipiattaforma che scova tutti i file che riesce a vedere...

CVE-2024-34221

मानव संसाधन प्रबंधन प्रणाली परियोजना PHP और MySQL में निःशुल्क स्रोत कोड प्रस्तुतकर्ता: Kha Do भेद्यता असुरक्षित अनुमति विवरण SourceCodester मानव संसाधन प्रबंधन प्रणाली 1.0 में /hrm/controller/ccity.php?positionedit= में एक असुरक्षित अनुमति भेद्यता है, जो हमलावरों को उन फ़ंक्शनों तक पहुँचने की...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

iam-vulnerable

IAM Vulnerable Usa Terraform per creare il tuo playground AWS IAM di escalation dei privilegi vulnerabile di proposito. IAM Vulnerable utilizza il binario Terraform e le tue credenziali AWS per distribuire oltre 250 risorse IAM nel tuo account AWS selezionato. In pochi minuti, puoi iniziare a...

PurplePanda

PurplePanda Dieses Tool ruft Ressourcen aus verschiedenen Cloud-/SaaS-Anwendungen ab, wobei der Fokus auf Berechtigungen liegt, um Privilege-Escalation-Pfade und gefährliche Berechtigungen in den Cloud-/SaaS-Konfigurationen zu identifizieren. Beachten Sie, dass PurplePanda sowohl...

Adalanche

Adalanche Open Source Attack Graph Visualizer and Explorer Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and...

Adalanche

Adalanche Open Source Visualizzatore ed Esploratore di Grafi di Attacco Adalanche fornisce risultati immediati, mostrandoti quali autorizzazioni hanno utenti e gruppi in Active Directory. È utile per visualizzare ed esplorare chi può assumere il controllo di account, macchine o dell'intero domini...

CVE-2026-35445

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CVE-2026-35445

Winter CMS versions prior to 1.2.13 contained an authorization bypass in the backend's form postback handler dispatch. The _handler POST field was passed directly to the handler dispatcher without validation, unlike AJAX requests which enforced the on[A-Z][\w+]* pattern. This allowed any authenti...

EUVD-2026-66631

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...