CVE-2020-17453-PoC

CVE-2020-17453 La consola de administración de WSO2 hasta la versión 5.10 permite XSS a través del parámetro msgId en carbon/admin/login.jsp. PoC Prueba de Concepto root@kitploit: https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Descubridores Nombre: Jackson Henry Twitter: @JacksonHHax...

CVE-2020-8816

CVE-2020-8816 一个用于利用CVE-2020-8816（Pi-hole上的远程代码执行漏洞）的Python脚本。 该脚本使用了François Renaud-Philippon发现的技术，对运行着低于4.3.3版本Web界面的Pi-hole实现远程代码执行。漏洞利用要求www-data用户的路径为/opt/pihole:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin。 root@kitploit: python3 .\CVE-2020-8816.py -h usage: CVE-2020-8816.py...

CVE-2023-32315

CVE-2023-32315 Openfire 的管理控制台（Admin Console）是一个基于 Web 的应用程序，被发现在 setup 环境中存在路径遍历漏洞。 这使得未认证用户可以利用已配置好的 Openfire 环境中的未认证 Openfire Setup Environment，访问本应仅供管理员使用的 Openfire Admin Console 中的受限页面，并可能导致远程代码执行 RCE。 截图 要求 Python3.7+ 支持的操作系统 Linux 用户 Windows 用户 开始使用 root@kitploit: $ git clone...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Openfire Authentication Bypass This repository highlights a high security issue impacting various versions of Openfire. Openfire, a cross-platform real-time collaboration server utilizing the XMPP protocol developed by the Ignite Realtime community, faces a severe vulnerability...

CVE-2023-32315

CVE-2023-32315 - Vulnerabilidad de Path Traversal en Ignite Realtime Openfire ⚠️ Solo para fines educativos y de investigación de seguridad autorizada Autores originales del exploit Muy agradecidos al autor original del PoC phith0n y a K3ysTr0K3R Descripción Openfire es un servidor XMPP bajo la...

CVE-2025-52357

CVE-2025-52357 : Aviso de seguridad: XSS en la consola de administración del router FD602GW-DX-R410 Prueba de concepto y aviso de seguridad para la vulnerabilidad de XSS reflejado en la consola de administración del router de fibra FD602GW-DX-R410 firmware V2.2.14. Incluye detalles, impacto y guí...

OpenFire_Decrypt

OpenFireDecrypt OpenFire 管理后台账号密码解密 install openfire https://hub.docker.com/r/sameersbn/openfire docker pull sameersbn/openfire:3.10.3-19 root@kitploit: docker run --name openfire -d --restart=always \ --publish 9090:9090 --publish 5222:5222 --publish 7777:7777 \ --volume...

CVE-2026-2587-Exploit-POC

CVE-2026-2587 Exploit PoC — Validador de inyección EL/RCE en Eclipse GlassFish Validador PoC seguro para CVE-2026-2587, un problema crítico de inyección EL/RCE que afecta el manejo de gadgets de la consola de administración de Eclipse GlassFish a través de /common/gadgets/gadget.jsf. Esta...

Oracle iPlanet Web Server 7.0.x - Image Injection

Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. id: CVE-2020-9314 info: name: Oracle iPlanet Web Server 7.0.x - Image Injection author:...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

CVE-2026-2586

经过身份验证的GlassFish EL注入RCE（CVE-2026-2586） GlassFish管理控制台中存在一个表达式语言注入漏洞，允许经过身份验证的用户将恶意的EL表达式注入到管理Web界面处理的参数中。成功利用该漏洞可能导致在受影响服务器上远程执行命令。 该漏洞在服务器虚拟配置编辑流程中被发现，在此流程中，用户可控的参数被应用程序不安全地解释。 原因如下： 管理界面在处理EL表达式时使用了用户可控的参数。 输入在后端解释之前未经过适当的验证或清理。 管理控制台中经过身份验证的用户可以滥用此漏洞行为来调用Java类和方法。...

cve-2023-42820

cve-2023-42820 JumpServer 影响版本 v2.24 - v3.6.4 造成危害 在知道jumpserver管理台的用户账户对应的邮箱的情况下（默认为 admin/[email protected]） 可通过漏洞重置管理台的管理员用户密码，并且配合jumpserver的 CVE-2023-42819 漏洞，最终可以getshell show...

MAL-012

MAL-012: Cross-Site Scripting Reflejado en la Consola de Administración que conduce a Ejecución Remota de Código en Payara Server Se encontró un ataque de Cross-Site Scripting XSS reflejado en la Consola de Administración de Payara. Al convencer a un usuario administrador de que acceda a la URL...

CVE-2026-84839

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-84839

tsi-coop tsi-dpdp-cms (up to 0.5.0 ) is affected by a missing authentication vulnerability in the web.xml file of the Admin Console/DPO Compliance Console component. A remote attacker can access the console without authentication, leading to a partial confidentiality impact. The exploit has been ...

CVE-2026-84839 tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

Glassfish-research

Investigación de Seguridad de GlassFish Investigación de vulnerabilidades en la consola de administración de Eclipse GlassFish...

CVE-2020-14882-WebLogic-Analysis

Investigación de vulnerabilidades: Explotación de la cadena CVE-2020-14882 y CVE-2020-14883 en Oracle WebLogic Server El repositorio contiene un informe técnico Write-up y una prueba de concepto PoC para demostrar la cadena de vulnerabilidades de omisión de autenticación Authentication Bypass y...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...