CVE-2020-0618

CVE-2020-0618 RCE in SQL Server Reporting Services CVE-2020-0618 Schwachstellenverifikation POC Sie können die folgende HTTP-Anfrage an den Server senden, um die Anwendung auszunutzen: root@kitploit: POST /ReportServer/pages/ReportViewer.aspx HTTP/1.1 Host: target Content-Type:...

cve-2020-0688

cve-2020-0688 cve-2020-0688 Die Anmeldung mit einem Benutzer, der über eine E-Mail-Adresse verfügt, ist unproblematisch. Hole VIEWSTATEGENERATOR aus dem Seitenquelltext Hole den Wert des ASP.NETSessionId-Cookies für den viewstateuserkey-Wert YSO hier herunterladen root@kitploit: ysoserial.exe -p...

CVE-2020-0688

CVE-2020-0688 Execução Remota de Código RCE por Chave Criptográfica Fixa no Microsoft Exchange Server Em vez de ter chaves geradas aleatoriamente por instalação, todas as instalações do Microsoft Exchange Server possuem os mesmos valores validationKey e decryptionKey no web.config. Assim, um...

CVE-2025-53770-Scanner

CVE-2025-53770 Scanner von DanSec Ein einfaches, effektives Aufklärungstool zur Identifizierung potenzieller Gefährdung durch die kritische SharePoint-Sicherheitslücke CVE-2025-53770. !Warning Dieses Tool ist ausschließlich für autorisierte Testzwecke bestimmt. Der Autor DanSec übernimmt keinerle...

CVE-2025-53770-Exploit

CVE-2025-53770-Exploit पहले, लक्षित SharePoint पृष्ठ से VIEWSTATEGENERATOR, VALIDATIONKEY, VALIDATIONALG मान प्राप्त करें: root@kitploit: curl -s https://target.com/layouts/15/start.aspx | grep -oP 'VIEWSTATEGENERATOR" value="\K^"+' curl https://target.com/layouts/15/spinstall0.aspx फिर,...

CVE-2025-30406

भाग 1: एक्सप्लॉइट root@kitploit: λ CVE-2025-30406.exe rce.txt...

CVE-2025-53690-Analysis

CVE-2025-53690: Sitecore ViewState反序列化漏洞分析 概述 CVE-2025-53690 是 Sitecore 产品线中发现的一个 ViewState 反序列化漏洞，通过利用泄露的 ASP.NET machine key 可实现远程代码执行，属于严重安全漏洞。 基本信息 CVE ID : CVE-2025-53690 CVSS 评分 : 9.0 Critical 漏洞类型 : 不可信数据反序列化 CWE-502 发现日期 : 2025年9月 公开日期 : 2025年9月3日 实际利用 : 自2024年12月起作为零日漏洞被利用 受影响产品 Sitecore...

CVE-2020-0688

CVE-2020-0688 In Microsoft Exchange Server besteht eine Remote-Codeausführung-Schwachstelle, wenn der Server bei der Installation keine ordnungsgemäß eindeutigen Schlüssel erzeugt. Die Kenntnis des Validierungsschlüssels ermöglicht es einem authentifizierten Benutzer mit einem Postfach, beliebige...

sharepoint-toolshell-micro-postmortem

Micropost-mortem de Incidente — Campanha “ToolShell” do Microsoft SharePoint On-Prem Este kit realiza a triagem da campanha de dia zero “ToolShell” de meados de 2025 contra o Microsoft SharePoint Server local ; o SharePoint Online está fora do escopo. Ele fornece caças reproduzíveis de ponta a...

Blackash-CVE-2025-53770

🧠 CVE-2025-53770 : Vulnerabilità RCE Critica in SharePoint Sfruttata tramite ViewState Forgery 📌 Panoramica della Vulnerabilità Tipo : Remote Code Execution RCE Punteggio CVSS : 9.8 Critico Componente : Microsoft SharePoint Server on-prem Causa Principale : Deserializzazione non sicura dei dati...

CVE-2026-57527 ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

PT-2026-52794

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System LMS popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon. The vulnerability, tracked as...

VulnCheck KEV: CVE-2026-5426

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

CVE-2026-5426

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

EUVD-2026-23271

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

CVE-2026-5426

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

CVE-2026-5426

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

CVE-2026-5426 KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks...

CVE-2025-71260

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE paramete...