CVE-2017-1000117

CVE-2017-1000117 ¿Cómo funciona? root@kitploit: $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git Cómo crear este repositorio root@kitploit: $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $...

system_bt_AOSP10_r33_CVE-2020-0377

Pila Bluetooth Fluoride Compilación y ejecución en AOSP Simplemente compile AOSP - Fluoride está allí por defecto. Compilación y ejecución en Linux Instrucciones para Ubuntu, probado en 14.04 con Clang 3.5.0 y en 16.10 con Clang 3.8.0 Descargar fuente root@kitploit: mkdir /fluoride cd /fluoride g...

CVE-2023-39361

CVE-2023-39361 Inyección SQL no autenticada en Cacti v1.2.24 Resumen Cacti es una herramienta de monitoreo operativo de código abierto escrita en PHP, MySQL/MariaDB, que proporciona una interfaz amigable. La vulnerabilidad fue descubierta en 2023 y afecta a todas las versiones anteriores a la...

CVE-2021-44228-log4Shell

CVE-2021-44228-log4Shell exploit Exploit Test runs ping to google.com execute any command prints OS name, version and arch collect details about the OS and User opens calculator on remote machine can execute any executable download this README.md from github Run the ExploitTest root@kitploit: jav...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364

The wlc Weblate command-line client is vulnerable to unauthorized API token disclosure in versions prior to 2.0.1 . If an unscoped API token is provided via WLC_KEY or --key without an explicit WLC_URL or --url, the application may automatically use a project-configured URL from files like .webla...

EUVD-2026-84823

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-49811

A flaw was found in Dell Command | Monitor. A low privileged attacker with local access could potentially exploit an incorrect permission assignment for a critical resource. This could lead to an elevation of privileges, allowing the attacker to gain higher system permissions...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

vBulletin-CVE-2025-48828-Multi-target

💥 Scanner de Ejecución Remota de Código en vBulletin replaceAdTemplate Esta herramienta Python automatiza la detección de vulnerabilidades RCE sin autenticación en vBulletin a través del vector de explotación replaceAdTemplate. Basada en la prueba de concepto original de EgiX , esta versión sopor...

Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...

MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...

CVE-2023-49367

CVE-2023-49367 - Exposición de Datos Sensibles Exposición de datos sensibles en el Panel Web de la Impresora Kyocera Fabricante: Kyocera Corporation Versiones Afectadas: Command Center RX - EXOSYS M5521cdn Descripción Después de conectarse a la libreta de direcciones de la interfaz de Kyocera, se...

microsandbox: Secret values exposed in world-readable process arguments

Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...

GHSA-M8F5-RH7H-VGG3 microsandbox: Secret values exposed in world-readable process arguments

Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...

sqlwinds

SQLWinds Kit de Evaluación de Seguridad y Post-Explotación para SQL SQLWinds es una herramienta de línea de comandos para pruebas de seguridad y explotación de Microsoft SQL Server. Proporciona un entorno interactivo para analizar servidores en profundidad, escalar privilegios, ejecutar ataques y...

podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives

The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...

CVE-2022-1388

Vulnerabilidad de iControl REST en BIG-IP CVE-2022-1388 PoC Esta vulnerabilidad puede permitir que un atacante no autenticado con acceso de red al sistema BIG-IP a través del puerto de administración y/o las direcciones IP self ejecute comandos arbitrarios del sistema, cree o elimine archivos, o...