CVE-2026-66492

Pfad-Traversal im Zielverzeichnis des Datei-Uploads PhocaCommander ≤ 6.1.3 — Authentifizierter Administrator schreibt Dateien außerhalb des Webroot ZUSAMMENFASSUNG Der Datei-Upload-Handler in PhocaCommander erstellt den Zielpfad aus einem angreiferkontrollierten, base64-kodierten folder-Parameter...

poc-CVE-2026-64638-

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth-XSS → RCE-Exploit-Kette, basierend auf Forschung von pwn.ai, veröffentlicht auf ionsec.io. ⚠️ RECHTLICHER HINWEIS : Nur für BILDUNGSZWECKE und AUTORISIERTE TESTS. Verwenden Sie es nur gegen Systeme, die Ihnen gehören oder für die Sie eine...

KitHack

KitHack è un framework progettato per automatizzare il processo di download e installazione di diversi strumenti per test di penetrazione, con un'opzione speciale che consente di generare backdoor multipiattaforma tramite Metasploit Framework. Avvertenza DEPRECATO. Distribuzioni compatibili con...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 kritische Remote Code Execution RCE Schwachstelle entdeckt in Apache Tomcat betrifft Systeme mit aktivierten HTTP PUTs durch Setzen des Initialisierungsparameters "read-only" des Default-Servlets auf "false" sind betroffen. Tomcat-Versionen vor 9.0.1 Beta, 8.5.23,...

twitter-advanced-search

🔍 Erweiterte Suche auf Twitter Diese Operatoren funktionieren im Web, auf Mobil, in Tweetdeck. Es gibt einige Überschneidungen, aber größtenteils funktionieren sie nicht für die v1.1 Search, Premium Search oder v2 Search APIs. Adaptiert von der TweetDeck Hilfe, @lucahammer Anleitung, @eevee Twitt...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

exploit-CVE-2017-7494

SambaCry-RCE-Exploit für Samba 4.5.9 Samba ist eine freie Software-Neuimplementierung des SMB/CIFS-Netzwerkprotokolls. Samba stellt Datei- und Druckdienste für verschiedene Microsoft-Windows-Clients bereit und kann in eine Microsoft-Windows-Server-Domäne integriert werden, entweder als...

ExecuteAssembly

Descrizione: ExecuteAssembly è un'alternativa a CS execute-assembly, costruito in C/C++ e può essere utilizzato per caricare/iniettare assembly .NET tramite; riutilizzo dei moduli CLR/AppDomainManager caricati dal processo host spawnto, stomping dei loader/assembly .NET degli header PE DOS,...

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

GHSA-35CR-9HQQ-P2MG Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

Snipe-IT has incorrect permission for legacy license checkin API

Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...

GHSA-8FRH-VHGH-64CF Snipe-IT has incorrect permission for legacy license checkin API

Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...

GHSA-53JC-27PC-X8R8 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

Snipe-IT vulnerable to directory traversal in displaySig

Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...

GHSA-C6F4-WJ38-M3G3 Snipe-IT vulnerable to directory traversal in displaySig

Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...

CVE-2025-10952-ml-logger-AFR

CVE-2025-10952 — Beliebiger Dateizugriff über streamhandler in ml-logger Dieses Repository stellt ein eigenständiges Python-Skript bereit — CVE-2025-10952.py — das eine nicht authentifizierte Schwachstelle für beliebigen Dateizugriff in ml-logger's streamhandler ausnutzt, verkettet mit dem...

krie

KRIe KRIe ist ein Forschungsprojekt, das darauf abzielt, Linux-Kernel-Exploits mit eBPF zu erkennen. KRIe ist weit davon entfernt, eine wasserdichte Strategie zu sein: Von eBPF-bedingten Einschränkungen bis hin zu Post-Exploitation-Erkennungen, die möglicherweise auf einen kompromittierten Kernel...

GHSA-WG2F-X2C2-C4RP Snipe-IT has an Open Redirect After User Edit

Impact The user edit flow stores url-previous into Laravel's intended URL session value and later redirects with redirect-intended... when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal...