CVE-2019-16113-Dockerfile

Bluditディレクトリトラバーサル脆弱性（CVE-2019--16113） Bludit-3.9.2 は軽量CMSであり、LAMP環境があれば実行できます。画像アップロード時、Bluditはファイル拡張子をチェックした後、ファイルを適時に削除しないため、攻撃者はuuidパラメータを制御することでディレクトリトラバーサルを実現できます。詳細は参照 脆弱性環境 以下のコマンドを実行してイメージをビルドし、Bluditコンテナを起動します root@kitploit: cd Docker sudo docker build -t bludit:cve . 编译镜像 sudo docker r...

CVE-2026-55255-Lab

CVE-2026-55255 - LangflowのIDOR脆弱性（/api/v1/responses） エグゼクティブサマリー このリポジトリには、LangflowのOpenAI互換Responses APIに影響を与える不適切な直接オブジェクト参照 IDOR 脆弱性であるCVE-2026-55255を再現および検証するためのローカルDockerラボが含まれています。...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py の再実装 最初のパストラバーサル悪用後のリモートサーバーのクラッシュを避けるため、リクエストするファイル名の一部に uuid を使用します。 run.py / shell.py: ローカルコンテナを実行するための podman 上のラッパー...

bluffy

Bluffy シェルコードを ✨ 異なる ✨ フォーマットに変換！ Bluffyは、シェルコードを現実的なデータ形式にフォーマットすることで、アンチウイルス製品を（静的に）バイパスする実験で使用されたユーティリティです。 0xBoku氏のNinjaUUIDRunnerやChoiSG氏のUuidShellcodeExecなどの概念実証ツールが、Bluffyの初期コンセプトに影響を与えました。 現在までに、以下を実装しています： 1. UUID 2. CLSID 3. SVG 4. CSS 5. CSV ヘルプ root@kitploit: $ python3 bluffy.py -h...

FUD-UUID-Shellcode

FUD-UUID-Shellcode はじめに C++ を使用した別のシェルコードインジェクション手法で、XOR 暗号の魔術と UUID 文字列の 狂気 を使って Windows Defender を回避しようと試みます :。 動作の仕組み シェルコードの生成 まず、バイナリ形式でペイロードを生成します（Havoc、CobaltStrike、msfvenom のいずれかを使用）。例えば msfvenom では以下のように行います（使用しているペイロードは 説明用 です。任意のペイロードを使用できます）： root@kitploit: msfvenom -p...

CVE-2026-82658

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php . An authenticated low-privilege user can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID, disclosing that user's future rol...

Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

CVE-2025-22828

CVE-2025-22828 📜 Descrizione Apache CloudStack dalla versione 4.16.0 in poi presenta un problema di controllo degli accessi non corretto che consente a utenti con conoscenza degli UUID delle risorse di leggere o aggiungere commenti annotazioni su risorse a cui non sono autorizzati ad accedere. Gl...

CVE-2026-54746

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

PT-2026-83170

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

RDL-detect

Verificação do Serviço Remote Desktop Licensing Referência: https://github.com/fortra/impacket/blob/master/examples/rpcdump.py Enumera os serviços abertos via MSRPC e, com base no UUID: 3d267954-eeb7-11d1-b94e-00c04fa3080d, determina se o Terminal Server Licensing está presente. Uso: python3...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Panoramica Questo repository contiene la Proof of Concept PoC per CVE-2026-24134 , una vulnerabilità di Broken Object Level Authorization BOLA in StudioCMS. Contenuti cve202624134poc.py - Script di sfruttamento in Python Prerequisiti StudioCMS=0.1.1 root@kitploit: pip install...

bluesnoop

bluesnoop Un semplice sniffer Bluetooth Low Energy BLE che utilizza Python e la libreria Bleak Caratteristiche Identifica UUID e nomi dei dispositivi vicini Monitoraggio persistente della prima e dell'ultima apparizione Traduzione di ID modello criptici Esporta intelligence per analisi esterne...

CVE-2026-62283

Nezha Monitoring (a self-hostable server and website monitoring tool) versions 1.14.13–1.14.14 and 2.0.0–2.0.9 contain a cross-tenant session hijack vulnerability. Stream identifiers created by CreateStream in service/rpc/io_stream.go are not bound to their creating user, and the WebSocket endpoi...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

EUVD-2026-63730

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

PT-2026-79458

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.14.13 through 1.14.14 Nezha Monitoring versions 2.0.0 through 2.0.9 Description Nezha Monitoring fails to bind stream identifiers created by the CreateStream function in service/rpc/io stream.go to the user who...