text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable

CVE-2026-11115 – Inyección de cadena de conexión de base de datos a través de variable de entorno Código del programa Python root@kitploit: dbconnector.py - Constructs DB connection string from environment import os, psycopg2 def connect: Reads DBURL; attacker can override via environment injecti...

CVE-2019-11043

CVE-2019-11043 概念验证 CVE-2019-11043 漏洞利用的 Python 版本 https://github.com/neex/phuip-fpizdam 此概念验证仍为草案，请使用由 @neex 编写的利用工具 漏洞分析：https://paper.seebug.org/1064/ 概念验证环境搭建 运行 docker compose 启动 nginx 和 php-fpm： root@kitploit: docker-compose up -d Creating network "cve-2019-11043-gitappnet" with driver...

how-to-check-patch-secure-log4j-CVE-2021-44228

How-to-check-log4j-CVE-2021-44228 What is log4j ? LOG4J is a open-source Java-based Apache Software used for logging services. What is log4j Vulnerability CVE-2021-44228 ? The Log4j vulnerability allows remote code execution by simply typing a specific string into a textbox , works on every progr...

CVE-2019-0232

CVE-2019-0232 Apache Tomcat CGIServlet enableCmdLineArguments 远程代码执行（RCE） 通过查询字符串参数进行 Windows 批处理脚本注入 描述 当 Apache Tomcat 启用 CGI servlet 且设置 enableCmdLineArguments=true 时，会将查询字符串参数作为命令行参数传递给 CGI 脚本。在 Windows 上，批处理文件（.bat/.cmd）会将 & 解释为命令分隔符，从而允许通过精心构造的 URL 执行任意命令。 前提条件 已在 conf/web.xml 或...

CVE-2026-31816

CVE-2026-31816 - Budibase 认证绕过至远程代码执行（RCE） CVE-2026-31816 是一个影响 Budibase 的严重认证与授权绕过漏洞。 该漏洞存在于负责保护 API 端点的服务端授权中间件中。Budibase 尝试使用一个未锚定的正则表达式来识别合法的 Webhook 端点，并将该表达式作用于 Koa 的 ctx.request.url。 由于 ctx.request.url 包含查询字符串，攻击者可以将一个看起来像 Webhook 的路径注入到原本无关的 API 请求的查询组件中。 例如： root@kitploit:...

CVE-2026-3008

CVE-2026-3008 — Notepad++ 8.9.3 通过 nativeLang.xml 注入格式字符串 漏洞描述 当搜索操作产生结果时，sub1400916C0 通过从 nativeLang.xml 中检索本地化字符串并将其直接作为格式字符串传递给 wsprintfW 来格式化命中计数标签： root@kitploit: sub140099E60v37, v51, unsigned int a1 + 196; // 获取本地化字符串 v38 = const WCHAR v51; if v53 7 v38 = v510; // SSO：堆指针 wsprintfWLPWSTRa1...

DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

CVE-2026-12717

CVE-2026-12717 is an Improper Input Validation vulnerability in the CData JDBC driver integration within Google Cloud BigQuery Data Transfer Service (versions prior to 2026-05-01). An authenticated attacker can achieve remote code execution in the connector container and escalate privileges in th...

UBUNTU-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

FreeBSD-SA-26:61.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:61.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2026-08-25 Credits:...

CVE-2026-53572

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

EUVD-2026-64131

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection

A flaw was found in Ruby JSON. This vulnerability, a format string injection, allows a remote attacker to cause a denial of service DoS or disclose sensitive information. The flaw occurs when processing specially crafted user-supplied documents with the allowduplicatekey: false parsing option...

PT-2026-79044

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An SQL injection issue exists due to improper neutralization of special elements used in an SQL command. This occurs via unvalidated MyBatis $-sign interpolation within the...

CVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

CVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

CVE-2026-12004

CVE-2026-12004 is a format-string injection vulnerability in the IBM Security Verify Access management interface, affecting IBM Security Verify Access 10.0–10.0.9.2, IBM Verify Identity Access 11.0–11.0.3, and IBM Verify Identity Access Container 11.0–11.0.3. The issue can cause denial of service...

CVE-2026-12004 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...