562894 matches found
cve-2018-8174_analysis
Diseccionando un exploit moderno de navegador: caso de estudio de CVE-2018-8174 Resumen Cuando este exploit surgió por primera vez a finales de abril y principios de mayo, despertó mi interés, ya que a pesar de una fuerte ofuscación, la estructura del código parecía bien organizada y el código de...
CVE-2017-1000486
CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 o 6.0 - Exploit de Ejecución Remota de Código Para instalar los requisitos, ejecuta: root@kitploit: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Así se usa el exploit: root@kitploit: $ pyth...
dref
Marco de explotación de DNS Rebinding Este proyecto ya no se mantiene. dref realiza el trabajo pesado para el DNS rebinding. El siguiente fragmento de uno de sus payloads integrados muestra el framework siendo utilizado para escanear una subred local desde un navegador comprometido; después de...
CVE-2022-1329
WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Ejecución remota de código root@kitploit: Fecha: 16 de abril de 2023 Autor del exploit: Việt Hùng https://github.com/phanthibichtram12 Sitio web del proveedor: https://elementor.com/ Enlace del software:...
frida-snippets
& también ejemplos de salida Índice de Contenidos Nativo Cargar módulo C/C++ Watchpoint único Actividad de socket Interceptar open Ejecutar comando de shell Listar módulos Registrar consulta SQLite Registrar argumentos de método Interceptar módulo completo Volcar segmentos de memoria Escanear...
CVE-2025-61505
CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...
CVE-2025-22381
CVE-2025-22381: Inyección de cabecera Host en Aggie Análisis detallado y prueba de concepto para CVE-2025-22381, una vulnerabilidad de inyección de cabecera Host descubierta en el proyecto de código abierto Aggie. Resumen de la vulnerabilidad+ CVE ID: CVE-2025-22381 Publicado: octubre de 2025...
kraken
Warning I have been reviewing the Kraken-Client code and since this was my first ever react app, its old, clunky and it needs major improvement the server needs some work too. In the next few weeks/months I will do my best to rewrite it in either updated React or in another framework. Please feel...
ctftool
CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...
winmagic_sd
Informe técnico sobre CVE-2020-11519 y CVE-2020-11520 Fecha: Junio de 2020 Autor: Dennis Elser código: github Tabla de Contenidos Introducción Enfoque y Descripción Técnica CVE-2020-11519 CVE-2020-11520 Explotación de Prueba de Concepto Cronología de Divulgación Solución Sumas de Verificación...
RE11S_1.11-formAccept-CommandInjection
RE11S1.11-formAccept-CommandInjection During my internship at Qi An Xin Tiangong Lab, I discovered a command injection vulnerability in the RE11S1.11 router. By analyzing the webs file in the bin directory, I found that the function formAccept contains a command injection vulnerability. The...
CVE-2024-33210
CVE-2024-33210 Se ha identificado una vulnerabilidad de secuencia de comandos entre sitios XSS en Flatpress 1.3. Esta vulnerabilidad permite a un atacante inyectar scripts maliciosos en páginas web vistas por otros usuarios. Tipo de Vulnerabilidad: Secuencia de Comandos entre Sitios XSS Vendor de...
toxssin
toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...
CVE-2026-81699
opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...
CVE-2026-81687
opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...
CVE-2026-81678
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...
CVE-2026-78002
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...
Chimera
Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...