CVE-2024-27198_Lab

CVE-2024-27198 实验环境 描述 TeamCity 提供了一个仅限管理员访问的令牌管理页面，该页面未受认证保护。这使得未经认证的用户在能够找到现有用户 ID 的情况下，可以为管理员用户生成访问令牌。 CVE 详情 CVE ID：CVE-2024-27198 CWE：CWE-288 CNA：JetBrains s.r.o. 基础评分：9.8 严重 向量： CVSS:3.1 AV:N 网络 AC:L 低 PR:N 无 UI:N 无 S:U 不变 C:H 高 I:H 高 A:H 高 威胁情报与开源情报 实际影响与利用 CISA KEV 目录： 于 2024 年 3 月 7 日...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2026-36341

Vulnerabilidad de Cross-Site Scripting XSS en Webkul Krayin CRM Inyección HTML CVE: CVE-2026-36341 Resumen La vulnerabilidad es particularmente crítica porque afecta al Panel de Administración. En muchos flujos de trabajo de CRM, los gerentes o administradores de nivel superior revisan las...

CVE-2026-70425

Dell PowerScale OneFS versions 9.5.0.0–9.7.1.0, 9.8.0.0–9.10.1.0, and 9.11.0.0–9.14.0.1 are affected by a command injection vulnerability. A locally authenticated attacker with admin privileges can exploit it to escalate to root , impacting confidentiality, integrity, and availability. The CVSS 3...

7zip-CVE-2025-11001

使用： root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe 利用 7-zip 该漏洞仅在Windows上可利用，并且有一个主要注意事项。该漏洞仅在7-Zip以管理员权限运行时才能被成功利用。这是因为7-zip进程会创建一个符号链接，这在Windows上是需要特权的操作。 因此，只有在服务账户使用7-Zip时，利用才是有意义的。...

PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings Herramienta de exploit para la vulnerabilidad de omisión de autenticación en el plugin de WordPress Service Finder Bookings ≤ 6.0 📋 Índice Acerca de la Vulnerabilidad Detall...

CVE-2026-68484

Cash Collect by Sage contains an improper authorization vulnerability in the Sage AR Automation API . Administrative functions fail to properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and escalate to elevated privileges. The issue is ra...

Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials

Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...

CVE-2026-6145

CVE-2026-6145 — User Registration & Membership para WordPress: Omisión no autenticada de la aprobación del administrador Exploit de prueba de concepto para CVE-2026-6145 , una vulnerabilidad de autorización faltante en el plugin User Registration & Membership para WordPress ≤ 5.1.5 que permite a...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH 5G Core Key Rotation & Ghost Admin Auditor v1.1 © 2026 CYBERDUDEBIVASH – All Rights Reserved Global Authority in Zero-Trust 5G & Private Network Security Bhubaneswar, Odisha, India Production-grade tool for detecting & remediating CVE-2026-0622 Ghost Admin privilege escalation &...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE（CVE-2021-44967）- 经过身份验证的远程代码执行 本仓库包含针对 CVE-2021-44967 的功能性漏洞利用程序，该漏洞是 LimeSurvey 中一个经过身份验证的远程代码执行漏洞。 🎯 兼容性 已在以下版本上测试并确认可用： LimeSurvey 5.2.x LimeSurvey 6.x 🐛 漏洞概述 该漏洞允许拥有管理员权限的已认证用户上传恶意插件。由于 LimeSurvey 未严格验证插件 ZIP 文件的内容，也未阻止插件目录中 PHP 文件的执行，攻击者可通过直接访问上传的 shell 实现 RCE。 ✨ 功能特性 🤖 自动化利...

EUVD-2026-74937

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-20896

Código de la Prueba de Concepto CVE-2026-20896 Este script automatiza la explotación del fallo de lógica en la validación de rutas de la API de Gitea, permitiendo forzar al servidor a otorgar un token administrativo válido mediante un ataque de salto de directorio Directory Traversal en la cabece...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | Bypass de Autenticación SSO de FortiCloud Resumen Ejecutivo FortiCloud Single-Sign-On SSO, una función habilitada por defecto de fábrica una vez que registras cualquier FortiGate/FortiManager/FortiAnalyzer, contiene una vulnerabilidad crítica de bypass de autenticación. Un atacan...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2024-9933

CVE-2024-9933 WatchTowerHQ = 3.10.1 - 因缺少空值检查导致认证绕过至管理员 描述： WatchTowerHQ 的 WordPress 插件在 3.9.6 及之前版本中存在认证绕过漏洞。这是由于 'watchtowerotatoken' 的默认值为空，且 'PasswordLessAccess::login' 函数中缺少非空检查。这使得未认证的攻击者可以登录为 WatchTowerHQ 客户端管理员用户。 root@kitploit: State: PUBLISHED Score: 9.8 CVSS:...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...