Rogue-MySql-Server

Rogue-MySql-Server 编辑脚本并根据需要更改要读取的文件和服务器端口。运行脚本并连接到你的服务器，以便从客户端读取文件。 读取 mysql.log 以查看已读取的文件内容。...

MAL-014

MAL-014：VMware vCenter Server 中经过身份验证的任意文件读取 “com.vmware.appliance.version1.system.update.set” API 组件容易受到标志注入攻击，可结合 “com.vmware.showlog” 插件，以目标系统上 “root” 用户的身份读取任意文件。 注意： 此漏洞要求同时具备 vCenter SSH shell 的管理员访问权限，以及以低权限用户身份访问文件系统以创建符号链接文件和/或文件夹的权限。 协作： 此漏洞是与 Alexandru Bogdan 合作发现的。 要求： 此漏洞需要： 在受限制的...

Vmware_vCenter

Vulnerabilidad de lectura arbitraria de archivos sin autenticación en versiones antiguas de VMware vCenter Vulnerabilidad de lectura arbitraria de archivos en VMware vCenter sin autenticación PoC de: https://twitter.com/ptswarm/status/1316016337550938122 p. ej. root@kitploit:...

MAL-010

MAL-010: MBeans peligrosos accesibles a través de JMX en Apache James Al enumerar e inspeccionar los MBeans expuestos por el JMX en localhost, puerto 9999, se han identificado los siguientes vectores de ataque: Escritura arbitraria de archivos mediante Log4J Lectura arbitraria de archivos mediant...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 描述 Error Log Viewer By WP Guru 这个 WordPress 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 ⚙️ 安装所需的软件包 root@kitploit: pip install requests ⚙ 检查版本并下载默认文件 示例命令 root@kitploit: python CVE-2024-12849.py -u...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin...

AZL-99107 CVE-2026-85505 affecting package freeipmi 1.6.18-1

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - 缺少授权导致未认证的任意文件读取 描述 WordPress 的 Error Log Viewer By WP Guru 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使得未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 详情 类型 : 插件 Slug : error-log-viewer-wp 受影响版本 : 1.0.1.3 CVSS 分数 : 7.5 CVSS...

CVE-2021-43798

CVE-2021-43798:Grafana 任意文件读取漏洞 添加了 Windows+Linux 全版本识别的 nuclei 模板 52个插件列表： root@kitploit: live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canvas grafana welcome xychart heatmap postgres testdata opentsdb influxdb barchart annolist bargauge...

CVE-2026-85505

A stack-based out-of-bounds read vulnerability was found in the FreeIPMI ipmi-oem utility. When processing an abnormally short response from a Baseboard Management Controller BMC, the application over-reads the buffer. A malicious BMC could exploit this to crash the client application Denial of...

CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

EUVD-2026-70883

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

CVE-2026-85505

FreeIPMI before 1.6.19 contains a stack-based buffer over-read in the ipmi-oem component, specifically in the function ipmi_oem_fujitsu_get_sel_entry_long_text (file ipmi-oem/ipmi-oem-fujitsu.c). The flaw is triggered when a Baseboard Management Controller (BMC) provides a short response , allowi...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator Focusing on UNC2452 TTPs Overview This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so calle...