BypassFuzzer

Bypass Fuzzer 原始的 403fuzzer.py : ==注意：此工具已被弃用，请使用我的全新 Burp 扩展，它比这个好 1000000%。感谢您使用我的工具！== 您可以在此处找到该扩展：https://github.com/intrudir/BypassFuzzer-Burp Fuzz 401/403 端点以寻找绕过方法 通过请求头、路径标准化、HTTP 方法等多种方式执行检查，尝试绕过 ACL 或 URL 验证。 输出每个请求的响应码和长度，以整洁、彩色编码的方式呈现，便于阅读。 “智能”过滤器，可在多次出现相同响应后自动静音。 从 Burp 导入原始 HTTP 请求...

Cisco-SNMP-Slap

VISIÓN GENERAL cisco-snmp-slap utiliza la suplantación de direcciones IP para evadir una ACL que protege un servicio SNMP en un dispositivo Cisco IOS. Normalmente, la suplantación de IP tiene un uso limitado en ataques reales, aparte de DoS. Ningún servicio TCP puede completar el handshake inicia...

SkypeACLKeyGen.exe-analysis-for-hacking-team

Análisis de SkypeACLKeyGen.exe del hacking team Así que... ¿qué analizamos hoy? bueno, hoy analizamos un software del hacking team. ¿Va sobre Skype? ¿por qué hacemos esto? no sé, me resulta interesante. En fin, empezamos inspeccionando el comportamiento en tiempo de ejecución. Como podéis ver,...

CVE-2026-85395

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

EUVD-2026-70672

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-85395 UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-85395

UnoPim before 2.1.3 is affected by a missing authorization vulnerability in the Bouncer middleware . The integration store, update, and key-generation routes were omitted from the ACL map, allowing any user with minimal admin privileges to bypass permission checks. An attacker can create OAuth AP...

CVE-2026-78064

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw...

smbclient-ng

smbclient-ng, a fast and user friendly way to interact with SMB shares. !NOTE Check out the new smbclient-ng written in Go, faster and cross platform by default! https://github.com/TheManticoreProject/smbclient-ng Features acls: List ACLs of files and folders in cwd. Syntax: acls : Pretty prints...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — RCE autenticado mediante bypass de ACL en Fórmulas + Path Traversal en sourceId de Adjuntos + Envenenamiento de .htaccess Autor : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Producto : EspoCRM = 9.3.3 Auth : Se...

CVE-2026-24306

Azure Front Door Privilege Escalation – CVE-2026-24306 PoC For authorized red team / research use only. Author not responsible for misuse. Vulnerability allows: Arbitrary routing rule injection Backend pool / origin group modification WAF policy attachment / override Custom domain takeover on...

CVE-2026-9789

ID de CVE: CVE-2026-9789 Investigador: Vo Duc Thang ugvxb Reconocimiento: https://community.acer.com/en/kb/articles/19670 Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. Resumen Ejecutivo Se ha descubierto una vulnerabilidad crítica de escalada de...

CVE-2026-84217

Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1...

CVE-2024-43998

CVE-2024-43998 Descripción CVE-2024-43998 : Vulnerabilidad de autorización faltante en el tema Blogpoet permite el acceso a funcionalidades no restringidas adecuadamente por ACLs. Este problema afecta a las versiones de Blogpoet desde n/a hasta 1.0.3. Uso root@kitploit: usage: CVE-2024-43998.py -...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

PoC--CVE-2019-10149_Exim

PoC-CVE-2019-10149Exim MNEMO-CERT ha desarrollado una PoC que permite ejecutar comandos con permisos elevados mediante el aprovechamiento de la vulnerabilidad CVE-2019-10149, que afecta distintas versiones de Exim 4.87 - 4.91. Para realizar el aprovechamiento local de esta vulnerabilidad es...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Ejecución Remota de Código RCE en la Interfaz de Usuario de Apache Spark 🔐 La interfaz de usuario de Apache Spark es susceptible a una vulnerabilidad de inyección de comandos remotos identificada como CVE-2022-33891. Este fallo surge debido al manejo inadecuado de la autenticació...

KINGSOFT-WPS-Office-LPE

JVN सलाह https://jvn.jp/en/vu/JVNVU90673830/ निम्नलिखित CVE संख्या निर्धारित की गई है: CVE-2022-25943 किंगसॉफ्ट WPS Office LPE WPS Office एक ऑफिस सुइट है जो Microsoft Windows, macOS, Linux, iOS, Android और HarmonyOS के लिए है, जिसे झुहाई-आधारित चीनी सॉफ्टवेयर डेवलपर किंगसॉफ्ट द्वारा विकसित किया ग...

cloudformation-waf-acl

cloudformation-waf-acl 一个用于预置和管理 AWS WAFv2 资源的 AWS CloudFormation 模板，包括 Web ACL、托管规则组、自定义正则表达式模式集和 IP 集。 组件 该模板预置以下资源： 1. 一个 AWS::WAFv2::WebACL。 2. AWS 托管防护规则组： AWSManagedRulesCommonRuleSet AWSManagedRulesKnownBadInputsRuleSet AWSManagedRulesAmazonIpReputationList AWSManagedRulesAnonymousIpList...