CVE-2017-13872-Patch

CVE-2017-13872-Patch 下载此软件并执行，它会要求您为 root 用户设置新密码。密码可能不同，但我认为，在默认选项下，它与 Admin 密码相同。 更新 您可以通过升级操作系统来修复此漏洞。...

CVE-2020-11444

CVE-2020-11444 Nexus 3 越权漏洞利用脚本 更多脚本文件另参：https://github.com/zhzyker/exphub Readme root@kitploit: +-----------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-11444 Nexus 3 Unauthorized Vuln...

CVE-2021-22911

针对 CVE-2021-22911 的更新版利用程序 Rocket.Chat 3.12.1 - NoSQL注入到远程代码执行 未认证 原始功劳归功于：https://www.exploit-db.com/exploits/50108 设置 创建Python虚拟环境并安装依赖 root@kitploit: $ python -m venv venv $ source venv/bin/activate $ pip install requests oathtool 使用方法 我新增了一个 -p 参数，用于接收低权限用户密码，同时也用于重置管理员密码 root@kitploit: $...

CVE-2019-9053-port-py3

CVE-2019-9053 漏洞利用 - Python 3 这是 CVE-2019-9053 漏洞利用的 Python 3 移植版本，针对 CMS Made Simple CMSMS 2.2.10 之前的版本。该漏洞允许通过 News 模块接口进行 SQL 注入。 示例输出 已在 TryHackMe Simple CTF Challenge 上测试。 描述 该利用程序利用了 CMS Made Simple 的 News 模块中的 SQL 注入漏洞。它可以： 提取 CMS 的 salt 导出管理员用户名 导出管理员邮箱 导出管理员密码哈希 可选使用提供的字典破解密码 快速开始...

CVE-2024-57429

CVE-2024-57429 PHPJabbers Cinema Booking System v2.0 的 pjActionUpdate 函数中存在一个跨站请求伪造（CSRF）漏洞，允许远程攻击者通过诱使已认证的管理员提交未经授权的请求来提升权限。 影响: 利用此 CSRF 漏洞可能导致未经授权的操作，例如： 更改管理员密码，从而有效地将其锁定在系统之外。 通过更新用户角色将攻击者的权限提升为管理员。 漏洞利用 - 概念验证 POC 跨站请求伪造 CSRF poc.html root@kitploit: history.pushState'', '', '/';...

CVE-2020-2733

CVE-2020-2733 - JD Edwards EnterpriseOne Tools 管理员密码保护不足 图 1: 解密字符串 图 2: 通过给定 URL 解密 CVE-2020-2733 应用程序: JD Edwards EnterpriseOne Tools 受影响版本: JD Edwards EnterpriseOne Tools 9.2 厂商 URL: https://oracle.com/ 漏洞类型: 信息泄露 报告日期: 2019年9月18日 公开安全公告日期: 2022年8月23日 参考:...

CVE-2024-48887-Exploit

CVE-2024-48887-Cambio de Contraseña No Verificado CWE-620 Resumen Una vulnerabilidad de cambio de contraseña no verificado en la interfaz gráfica de Fortinet FortiSwitch que permite a un atacante remoto no autenticado cambiar contraseñas de administrador mediante una solicitud especialmente...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

CVE-2024-5009

CVE-2024-5009 PoC para la escalada de privilegios de SetAdminPassword en Progress WhatsUp Gold CVE-2024-5009 Puedes encontrar un análisis de la causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ Uso root@kitploit:...

CVE-2023-44811

CVE-2023-44811 mooSocial v3.1.8 存在跨站请求伪造（CSRF）漏洞，一旦经过身份验证的管理员用户点击恶意构造的 HTML 页面，攻击者即可更改管理员密码。 我提供了 2 个 HTML 页面，当经过身份验证的管理员用户点击它们时，将更改其密码。...

tplink-CVE-2017-11519

tplink-CVE-2017-11519 POC para TP-Link Archer C9 - Restablecimiento de contraseña de administrador y RCE CVE-2017-11519 Consulta el writeup en https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html...

CVE-2024-40617

CVE-2024-40617 针对 CVE-2024-40617 的利用 PoC 描述 有关详细描述，请参阅 Medium 文章 Fujitsu M2M GW1500：从 M2M 到 M2M2P0wn 用法 root@kitploit: | / | \ | | \ / \ | |/| | | ' \ | | | | | \ \ /\ / / ' \ | | | |/ /| | | | | |/ /| /| || |\ V V /| | | | || |||| || |||| / // || || usage: CVE-2024-40617-PoC.py -h --version...

CVE-2023-24035

CVE-2023-24035 affects Nagios XI before 5.9.3 . The vulnerable component is the "Insecure Backend Ticket" Authentication mechanism, specifically the is_insecure_login_authenticated function, which uses a timing-unsafe comparison of the admin password. An attacker can exploit this by measuring tim...

EUVD-2023-60635

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

EUVD-2026-76737

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

CVE-2026-90457 involves an inconsistency in administrative password hashing across authentication paths in an ICS product (per CISA advisory ICSA-26-254-01). One path uses a weak, fast hashing algorithm , and the resulting hash file is written with permissions readable by any local user . A separ...

EUVD-2026-76350

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...