Purchase Order Management v1.0 - Cross Site Scripting (Reflected)

Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the password parameter at /purchaseorder/classes/login.php. id: CVE-2023-29623 info: name: Purchase Order Management v1.0 - Cross Site Scripting Reflected author: theamanrawat severity:...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

EUVD-2026-78074

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2024-5124

被害者サーバーのデプロイ: Docker のインストール root@kitploit: Install packages required for the installation sudo apt-get update sudo apt install --yes ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc sudo...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fix for the iteration of extrefs during log replay. When calling inodeaddref and processing extrefs, if we jump to the next label, the value of victimname.len is undefined. This occurs because victimname.len wasn’t...

sack

sack ソーシャルエンジニアリング攻撃のためのセッション接続を特定します。 ========== これは、ソーシャルサポートのライブ攻撃を通じて被害者を追跡する最初のフレームワークです。 root@kitploit: Example of use: python sack.py 実行するにはrootモードである必要があります。 シンプルなモジュール開発のサポートがあります。 忘れてはならないもの stats.html ここであなたの被害者のフォローアップ統計を見ることができます。 root@kitploit: Modules go codename value...

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

PT-2026-90505

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

pv2-victim

pv2-victim authz 研究 - CVE-2026-3306 修复覆盖...

CyberSec2026

Victim 설치 VirtualBox에서 VM 시작 1. 다음으로 로그인하십시오: username: osboxes password: osboxes.org 2. 터미널을 엽니다 3. 인터넷 연결이 작동하는지 테스트하십시오. root@kitploit: ping 8.8.8.8 ping이 성공하지 않으면 NAT 인터페이스가 켜져 있는지 확인하십시오. 4. OS 업데이트 root@kitploit: sudo apt-get update 5. Git 설치 root@kitploit: sudo apt install -y git 6. Kali용 ...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking これは何ですか？ 攻撃者アプリと被害者アプリは、CVE-2021-33699Task Hijacking 脆弱性を練習するためのものです。 参考 https://naro-security.tistory.com/55...

CVE-2026-69590

CVE-2026-69590 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) . An unauthenticated, network-based attacker can exploit it with no user interaction to gain unauthorized access to the victim's machine. The CVSS 3.1 score is 9.8 (Critical) , with high im...

CVE-2026-76959

A Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance (Advanced Payment Management) stems from insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page that, when interacted with by an authenticated victim, triggers un...

CVE-2026-85227

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

vulnerabilities present in Microsoft Office

Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...