CVE-2023-35078

CVE-2023-35078 漏洞利用工具 root@kitploit: ██████╗ ███╗ ██╗███████╗███████╗ ██████╗ ██╔═████╗████╗ ██║██╔════╝██╔════╝██╔════╝ ██║██╔██║██╔██╗ ██║███████╗█████╗ ██║ ████╔╝██║██║╚██╗██║╚════██║██╔══╝ ██║ ╚██████╔╝██║ ╚████║███████║███████╗╚██████╗ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚══════╝ ╚═════╝ + CVE-2023-350...

Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. id: CVE-2024-32114 info: name: Apache ActiveMQ 6.x 6.1....

CVE-2025-50505

CVE-2025-50505 API no autorizada conduce a ejecución arbitraria de comandos y escalada de privilegios en Clash Verge Rev Descripción La vulnerabilidad se origina en un endpoint API no autenticado expuesto por el componente clash-verge-service, que se instala con privilegios elevados por defecto...

CVE-2023-35078

CVE-2023-35078 shodan dorks You can use the following shodan dorks to find public targets. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs You can use the following to transform data from shodan API to format suitable for the checking script: root@kitploit: jq -cr...

rewerse-engineering

rewerse engineering 一个非官方的 REWE API 客户端，使用 Go 和 Python 编写。它实现了 REWE 应用用于查询当前折扣（Angebote）、商品、市场和召回信息的公开可访问（无需认证）端点。 当前支持的 APK 版本：5.16.2（截至 06.08.26） !CAUTION 与 rewe api 通信所需的证书不包含在此仓库中。你需要从 APK 中提取它们。相关文档及适用于 Windows 的提取脚本可在 docs 目录中找到。 另请参阅 rewerse-ui。 快速开始 从 rewe apk 中提取证书 ；参见 docs 中的说明 使用该库： Go...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

CVE-2026-57579

CVE-2026-57579 affects Alchemy CMS , an open-source Ruby on Rails content management system. The unauthenticated GET /api/pages/nested endpoint (in Api::PagesController#nested) performs no authorization and does not scope page descendants by the caller's ability, allowing anonymous callers to ret...

CVE-2020-13937

Descripción Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha tiene una API REST que expone la información de configuración de...

cve-2025-9074-poc

CVE-2025-9074 教育用 PoC・概念验证代码 本仓库包含一个用于教育目的的 PoC，演示了利用 Docker Engine 的未认证远程 API 创建可读写主机文件系统的特权容器的风险。 执行文件为 poc.go。 重要：本 PoC 仅限用于教育及防御目的。禁止在第三方环境或未经授权的系统上执行。 危险性评估 综合评估：严重 预估 CVSS v3.1 基本分：9.8 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 依据： 未认证即可访问 TCP/2375 → PR:N, UI:N, AV:N 通过特权容器 +...

CVE-2025-9074-Docker-Desktop-API-Escape-PoC

🐚 docker-shell 一款轻量级、无依赖的 Bash 脚本，仅需 curl、dd、od 和 awk，即可在 Docker 容器内获得模拟交互式 Shell 。无需 Python、无需 jq、无需编辑器。 专为仅有原始 Shell 访问权限、需通过 Docker Engine API 在 Docker 容器内执行命令的环境而设计。 🧠 工作原理 该脚本不依赖 Docker CLI，而是直接与 Docker Engine REST API 通过 HTTP 通信（在 Docker Desktop / WSL2 环境中，默认暴露于 http://192.168.65.7:2375）。...

monitorsfour

MonitorsFour — HackTheBox Plataforma: HackTheBox SO: Windows Estado: Retirada — walkthrough completo publicado. Walkthrough completo: l3dsec.com/walkthroughs/monitorsfour-htb Cadena de ataque root@kitploit: Nmap → nginx 80 + WinRM 5985 → ffuf → cacti.monitorsfour.htb Cacti → endpoint de API no...

CVE-2023-35078-Exploit-POC

PoC del exploit CVE-2023-35078 La vulnerabilidad de acceso remoto no autenticado a la API CVE-2023-35078 ha sido descubierta en Ivanti Endpoint Manager Mobile EPMM, anteriormente conocido como MobileIron Core. Esta vulnerabilidad afecta a todas las versiones compatibles: versión 11.4, lanzamiento...

CVE-2025-9074

CVE-2025-9074 – Windows 与 macOS 上 Docker Desktop 的完整 Docker 逃逸 📌 描述 Docker Desktop 将内部 Docker 引擎 API http://192.168.65.7:2375 暴露给 任何 正在运行的容器——没有身份验证，也没有访问控制 。 由于引擎本身可以挂载宿主机文件系统，容器可以调用此 API 来创建一个绑定挂载宿主机驱动器的容器 ，然后利用该容器读写宿主机上的任意文件 ——实现完整的容器到宿主机逃逸。 📝 参考资料 CVE-2025-9074 记录 Docker Desktop 发布说明（已在 4.44....

CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2026-86543 knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. An unauthenticated attacker can access the /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publi...

PT-2026-86936

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2026-86123

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-84452

Windows ML CLI (a command-line tool for building AI models for Windows) is vulnerable to arbitrary code execution via a CORS misconfiguration on its localhost HTTP API. Prior to version 0.4.0 , the cli_api.py and app.py components expose WinML CLI commands on localhost without authentication and ...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...