nextjs-cve-demo

範例: Authorization Bypass in Next.js Middleware CVE-2025-29927 這個 Repo 提供範例專案，演示 Next.js 中的 Middleware 授權繞過漏洞 CVE-2025-29927。此漏洞允許未經授權的用戶訪問受保護的資源。 漏洞概述 CVE-2025-29927 是一個嚴重的安全漏洞（CVSS 評分：9.1），影響 Next.js 的 middleware 系統。攻擊者可以通過在 HTTP 請求中添加特製的 x-middleware-subrequest header 來完全繞過 middleware 的安全檢查。...

CVE-2025-8088

安全分析：WinRAR 中的路径遍历漏洞利用（CVE-2025-8088） 注意： 仓库正在开发中。本项目将获得未来更新，包含额外的分析、 分析 （非利用）脚本和演示材料。新版本将在可用时发布。 本仓库记录了 WinRAR（CVE-2025-8088 ）中目录遍历 （CWE-35）漏洞的分析、研究过程和概念验证（PoC）。 该漏洞影响 7.13 之前版本的 Windows 版 WinRAR，已被评为高 严重性（基础评分 8.8）。 I. 感染过程：从 ZIP 文件到任意代码执行 CVE-2025-8088 的成功在于受害者所需交互的简单性：仅需解压一个恶意文件即可触发代码执行 。...

tough-cookie-patch-cve-2023-26136

RFC6265 Cookies y CookieJar para Node.js Sinopsis javascript var tough = require'tough-cookie'; var Cookie = tough.Cookie; var cookie = Cookie.parseheader; cookie.value = 'somethingdifferent'; header = cookie.toString; var cookiejar = new tough.CookieJar; cookiejar.setCookiecookie,...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 ADSelfService Plus RCE漏洞 检测工具 二开 描述 ZOHO ManageEngine ADSelfService Plus是卓豪（ZOHO）公司的针对 Active Directory 和云应用程序的集成式自助密码管理和单点登录解决方案。 网络测绘 fofa:"ADSelfService" app="ZOHO-ManageEngine-ADSelfService" header="JSESSIONIDADSSP"...

log4j2-CVE-2021-45105

Aplicación vulnerable de ejemplo Log4j2 CVE-2021-45105 Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.16.0 Esta aplicación está basada en una aplicación web Spring Boot vulnerable a CVE-2021-45105 Utiliza Log4j 2.16.0 Ejecutar la aplicación Ejecútala: root@kitploit: Import the...

CVE-2025-32463

CVE-2025-32463 - Sudo Chroot Privilege Escalation Exploit Overview CVE-2025-32463 is a critical local privilege escalation vulnerability in sudo versions 1.9.14 through 1.9.17. This vulnerability allows attackers with sudo privileges to escalate to root access by exploiting a design flaw in the...

EUVD-2026-72126

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2026-86259

OpenMAIC versions before 1.0.1 contain a server-side request forgery (SSRF) vulnerability in non-production builds where URL validation is gated by environment. Unauthenticated attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter, reaching cloud instance met...

CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress 预认证反射型 XSS → 远程代码执行链 DOM Clobbering + 应用密码窃取 + REST API 插件激活 = 完整 RCE ⚡ 概述 CVE-2026-64638 是 WordPress wp-login.php 中的一个严重预认证反射型 XSS 漏洞。该漏洞源于登录错误消息在回显提交的用户名时未进行正确的 HTML 编码 ，从而允许通过 进行 DOM Clobbering，绕过大多数过滤器。 当与 WordPress 的应用密码功能链式利用时，此 XSS 可成为完整远程代码执行 攻击链 ——...

exploit_dev_overview

ExploitDev Overview ExpDev Welcome Peeps to an short overvie...

class-dump

class-dump class-dump 是一个用于检查 Mach-O 文件中 Objective-C 段的 命令行实用程序。它会为类（class）、类别（category）和协议（protocol） 生成声明。这些信息与使用 'otool -ov' 获得的信息相同，但 以正常的 Objective-C 声明形式呈现。 最新版本和信息可在以下网址获取： root@kitploit: http://stevenygard.com/projects/class-dump 源代码也可从我的 Github 仓库获取： root@kitploit:...

CVE-2026-86254

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-86256

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

CVE-2026-86212

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86250

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

Redpoint

Redpoint Digital Bond 的 ICS 枚举工具 Redpoint 是 Digital Bond 的一个研究项目，用于枚举 ICS 应用和设备。 我们在评估中使用 Redpoint 工具来发现 ICS 设备并获取对二次测试有帮助的信息。其中部分工具将作为 Nmap NSE 脚本在本仓库中向公众开放。 Redpoint 工具使用合法的协议或应用命令来发现和枚举设备及应用。本工具不试图利用漏洞或使任何东西崩溃。然而，许多 ICS 设备和应用较为脆弱，任何意外流量都可能导致其崩溃或以意外方式响应，因此请谨慎使用。 每个脚本都在下面进行了说明，并以 .nse 文件形式存在于本仓库...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...