CVE-2020-14882

CVE-2020-14882 Oracle WebLogic Server Authentication Bypass Schwachstelle im Oracle WebLogic Server-Produkt von Oracle Fusion Middleware Komponente: Console. Betroffene unterstützte Versionen sind 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 und 14.1.1.0.0. Die leicht ausnutzbare Schwachstelle...

CVE-2019-18935

CVE-2019-18935 Telerik UI para ASP.NET AJAX RadAsyncUpload Handler Desserialização JSON .NET Lista de Versões root@kitploit: 2007.1423 2007.1521 2007.1626 2007.2918 2007.21010 2007.21107 2007.31218 2007.31314 2007.31425 2008.1415 2008.1515 2008.1619 2008.2723 2008.2826 2008.21001 2008.31105...

CVE-2016-4014

CVE-2016-4014 Componente UDDI do SAP Netweaver JAVA AS XXE root@kitploit: POST /uddi/api/replication HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Content-Type:...

CVE-2016-2386

CVE-2016-2386 SAP NetWeaver AS JAVA UDDI-Komponente SQL Injection root@kitploit: POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78...

AWS-SAM-CLI-Vulnerabilities

Vulnerabilidades do AWS SAM CLI CVE-2025-3047 & CVE-2025-3048 Este README fornece uma análise detalhada de duas vulnerabilidades de segurança encontradas no AWS Serverless Application Model CLI AWS SAM CLI – CVE-2025-3047 e CVE-2025-3048 – juntamente com os problemas e correções ao nível do códig...

SILENTTRINITY

SILENTTRINITY SILENTTRINITY ist ein modernes, asynchrones, Multiplayer- und Multiserver-C2/Post-Exploitation-Framework, das auf Python 3 und der .NET-DLR basiert. Es ist der Höhepunkt umfangreicher Forschung zur Nutzung eingebetteter .NET-Skriptsprachen von Drittanbietern, um dynamisch auf...

CVE-2018-7600

CVE-2018-7600 Drupalgeddon2 Exploit – Python3 HAFTUNGSAUSSCHLUSS: Dieses Projekt dient ausschließlich Bildungs- und autorisierten Penetrationstest-Zwecken. Verwenden Sie diesen Code NICHT auf Systemen, die Ihnen nicht gehören oder für die Sie keine ausdrückliche schriftliche Testgenehmigung...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atenbank-A ngriffs-W erkzeug ist ein Open-Source-Penetrationstest-Tool, das die Sicherheit von Microsoft SQL-Datenbanken remote testet. Anwendungsbeispiele von MSDAT: Sie haben eine Microsoft-Datenbank,...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Last week, there were 240 vulnerabilities disclosed in 184 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 105 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

bash-apocalypse

Bash Apocalipse Kit de exploração automatizada para CVE-2014-6271 Shellshock Um projeto completo de pesquisa em segurança demonstrando a vulnerabilidade Shellshock que afetou milhões de servidores em 2014. Inclui varredura automatizada, capacidades de exploração e recomendações defensivas. Demo O...

cve-2020-1472

CVE-2020-1472 POC Reproduktion dieser Schwachstelle in einer Windows-Domänenumgebung unter macOS über einen Proxychains-Proxy. Umgebung DCprimärer Domänencontroller: Domain UserDomänenmitgliedsrechner: Einrichten eines SOCKS5-Forward-Proxys direkt über gost. Attack HackerAngriffsrechner:...

CVE-2020-13405

CVE-2020-13405 Base Score: 7.5 HOCH🟥 MicroWeber ist ein Open-Source-Content-Management-System CMS, das in PHP geschrieben ist. Es ermöglicht Webadministratoren, einfach eine Website zu erstellen, indem sie Komponenten per Drag-and-drop an die gewünschte Position ziehen. Es ist eine beliebte Wahl...

CVE-2026-81735 UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735 UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

CVE-2026-81719 openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81719 openssl_encrypt before 1.4.9 Remote Code Execution via Plugin

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

CVE-2026-81716 openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...

CVE-2026-81716 openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...