CVE-2020-17496

CVE-2020-17496 root@kitploit: POST /ajax/render/widgettabbedcontainertabpanel?XDEBUGSESSIONSTART=phpstorm HTTP/1.1 Host: localhost User-Agent: curl/7.54.0 Accept: / Content-Length: 100 Content-Type: application/x-www-form-urlencoded subWidgets0template=widgetphp&subWidgets0configcode=echo...

EUVD-2026-68096

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2026-82447

Skyvern versions prior to 1.0.45 contain a sandbox escape vulnerability in the TextPromptBlock component. The root cause is a double-rendering flaw: prompts are first processed through a sandboxed Jinja environment and then re-processed through an unsandboxed one. An attacker with low privileges ...

CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2025-29927

Introduzione Falsificando l'header di richiesta x-middleware-subrequest è possibile aggirare il meccanismo di autenticazione del middleware di Next.js, consentendo l'accesso non autorizzato a route protette. Configurazione dell'ambiente Il codice sorgente del progetto è tratto da P神, con versione...

CVE-2022-36663-PoC

CVE-2022-36663-PoC Scanner di rete interna tramite blind SSRF su Gluu IAM Gluu IAM è vulnerabile a blind SSRF che può essere sfruttato per scansionare la rete interna alla ricerca di porte aperte in base ai tempi di risposta. https://nvd.nist.gov/vuln/detail/CVE-2022-36663 Per verificare se il...

nex-forms_SQL-Injection-CVE-2023-2114

nex-formsSQL-Injection CVE-2023-2114 https://vulners.com/cve/CVE-2023-2114 https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d Kurzer Überblick über die SQL-Injection im NEX-Forms Plugin für WordPress Hochgeladener Exploit Beachten Sie, dass dieser hochgeladene Exploit-Code nich...

Centreon-RCE

Centreon-RCE Centreon v.19.04 exploit di Remote Code Execution CVE-2019-13024 Revisione di https://github.com/mhaskar/CVE-2019-13024 COME USARE: 1. Modifica i valori predefiniti degli argomenti per comodità, oppure no in fondo allo script 2. Se necessario, modifica la funzione 'editcommand' per...

omigod-lab

Readme Una VM di laboratorio educativa per apprendere la vulnerabilità di esecuzione remota di codice RCE non autenticata con punteggio CVSS 9.6 nel software Open Management Infrastructure CVE-2021-38647. Divulgazione ricerca originale:...

CVE-2020-0601

CVE-2020-0601 PoC per CVE-2020-0601- Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall Su kali: 1.Crea un file PKCS12 root@kitploit: openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req -ne...

WAGO-CVE-2023-1698

WAGO-CVE-2023-1698 WAGO-System-Ferncodeausführungs-Schwachstelle CVE-2023-1698 Hinweis Ich habe ein Tool für lokale Tests und POC-Entwicklung entwickelt, das nur als technische Lernreferenz dient. Bitte verwenden Sie es nicht für illegale Zwecke. Direkte oder indirekte Konsequenzen und Verluste,...

CVE-2024-23346

CVE-2024-23346 Dieser PoC basiert auf dem Bericht/den Erkenntnissen von William Khem-Marquez und Matthew Horton: https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f Verwendung: python3 CVE-2024-23346.py -t targetURL -u username -p password -l localhost -P localpor...

CVE-2020-7247-POC

Vorwort Wesentliche Fakten zum Exploit Installation des verwundbaren Servers Konfiguration Hinweise zur Umgebung Exploit Manuelle Ausnutzung Skriptgesteuerte Ausnutzung Vorwort Dieses Repository soll als Grundlage dienen, um CVE-2020-7247 in einer kontrollierten und privaten Umgebung aufzusetzen...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL-Injection-Schwachstelle im Drupal Core Hochwirksame SQL-Injection-Schwachstelle im Drupal Core PostgreSQL 📋 Übersicht CVE-2026-9082 ist eine SQL-Injection -Schwachstelle in der Datenbank-Abstraktionsschicht von Drupal Core. Sie betrifft nur Websites, die PostgreSQL als...

cve-2026-71362-magento-lab

CVE-2026-71362 — Lab sul cambio di identità della sessione cliente di Magento / Adobe Commerce Un lab Docker autonomo, avviabile con un solo comando, che riproduce CVE-2026-71362 dall'inizio alla fine e consente di verificare la correzione di Adobe, così che difensori, ricercatori e studenti...

CVE_2019_18935

RAUcrypto Exploit combinato per Telerik UI for ASP.NET AJAX. Caricamento file per CVE-2017-11317 e CVE-2017-11357 - caricherà automaticamente il file Deserializzazione .NET per CVE-2019-18935 Affinché l'exploit funzioni, generalmente hai bisogno di una versione con chiavi hardcoded, oppure devi...

CVE-2026-14494

CVE-2026-14494 is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in the Sigma Forms Pro plugin for WordPress, affecting all versions up to and including 1.4.5 . The flaw resides in the handle_form_submission function, which dynamically grants the unfiltered_upload capab...

CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

EUVD-2026-68094

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...