CVE-2022-27925

CVE-2022-27925 説明 2022年5月10日、Zimbraは、CVE-2022-27924（以前に取り上げたもの）とCVE-2022-27925を含む、Zimbra Collaboration Suiteの複数の脆弱性に対処するため、バージョン9.0.0 patch 24および8.8.15 patch 31をリリースしました。...

CVE-2026-18730

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

CVE-2025-55182-POC-SCANNER

CVE-2025-55182: Critical Pre-Authentication RCE in React Server Components Security Research byschema.cx "Control is an illusion. It's the systems we build that control us—unless we understand them first." 📋 Table of Contents Disclaimer & Legal Notice Executive Summary Technical Description...

CVE-2007-2447

CVE-2007-2447 Samba Exploit A standalone Rust implementation of the CVE-2007-2447 exploit targeting Samba smbd 3.0.20-Debian. Vulnerability Description CVE-2007-2447 is a command injection vulnerability in Samba versions 3.0.0 through 3.0.25rc3. The vulnerability exists in the SamrChangePassword...

CVE-2025-29927

🔍 CVE-2025-29927 - Detector de Omisión de Middleware en Next.js Este escáner inteligente basado en Python ayuda a detectar la vulnerabilidad CVE-2025-29927 en aplicaciones Next.js: una omisión crítica de middleware que permite a los atacantes saltarse la autenticación usando una cabecera HTTP...

CVE-2026-10520

🎯 CVE-2026-10520 & CVE-2026-10523 - Ivanti Sentry Ejecución remota de código sin autenticación previa + Bypass de autenticación Autor: Ashraf Zaryouh "0xBlackash" 📌 Resumen Dos vulnerabilidades críticas que afectan a Ivanti Sentry anteriormente MobileIron Sentry: CVE-2026-10520 → CVSS 10.0 -...

CrushFTP-AS2-Bypass-Research-CVE-2025-54309

Investigación de Bypass de Autenticación AS2 en CrushFTP ⚠️ IMPORTANTE: Esta vulnerabilidad ha sido corregida por CrushFTP en noviembre de 2025. Esta investigación se publica con fines educativos y defensivos únicamente. 📝 NOTA: Esta investigación se basa en patrones de vulnerabilidad similares a...

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit Serverless Framework MCP Server CVE-2025-69256 Puntuación base: 9,4/10 → Puntuación CTT mejorada: 9,9/10 Una vulnerabilidad crítica de inyección de comandos en el servidor MCP Model Context Protocol de Serverless Framework,...

CVE-2025-13390

WP Directory Kit = 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover Summary The WP Directory Kit plugin for Wordpress version 1.4.4 and below contains an authentication bypass in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain...

CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2025-31161

CVE-2025-31161 Vulnerabilidad de omisión de autenticación en versiones del servidor CrushFTP...

CVE-2023-40028

CVE-2023-40028 PoC Exploit Symlink Upload Vulnerability in Ghost CMS Leading to Arbitrary File Read POC Image Vulnerability Details CVE-2023-40028 is a vulnerability in Ghost CMS versions prior to 5.59.1 , where authenticated users can upload symbolic links symlinks that lead to arbitrary file...

CVE-2022-4361

CVE-2022-4361 Description This repository contains a PoC for CVE-2022-4361. All the credits go to original author of the discovery, mulliken; IMPORTANT : this PoC is not complete as it does not cover the case for the AssertionConsumerServiceURL value on the SAML authentication protocol. Currently...

CVE-2023-27350

PaperCut NG/MG RCE CVE-2023-27350 A streamlined Bash exploit for CVE-2023-27350. This script automates authentication bypass, environment preparation, and command injection via the PaperCut printer scripting engine. Visual Proof Basic rce: Triggering a reverse shell: Quick Start root@kitploit:...

CVE-2025-3102

🔐 CVE-2025-3102 – Authentication Bypass in SureTriggers WordPress Plugin 🚨 CVE-2025-3102 is a critical authentication bypass vulnerability affecting the SureTriggers: All-in-One Automation Platform WordPress plugin, which is actively installed on over 100,000 websites. Due to the nature of the fl...

Filament: Password validity disclosure for accounts denied panel access on login page

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating canAccessPanel. For an account that canAccessPanel denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message,...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...