CVE-2020-9047

Menu de Uso/Ajuda root@kitploit: usage: CVE-2020-9047.py -h -p RPORT -s LPORT --command -d WEBDIR -U USERNAME -P PASSWORD WINDOWS,LINUX,CHECK RHOST LHOST PAYLOAD Exploit for exacqVision Web Service as outlined in CVE-2020-9047. This program targets Windows and Linux x86 installations of exacqVisi...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - OS Command Injection root@kitploit: Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a...

CVE-2019-12744

CVE-2019-12744 Informationen Exploit-Titel: Remote-Befehlsausführung durch nicht validierten Datei-Upload in SeedDMS-Versionen 5.1.11 CVE: CVE-2019-12744 Hersteller-Homepage: https://www.seeddms.org/index.php?id=2 Exploit-Autor: NobodyAtall Getestete Version: Seeddms 5.1.10, 5.0.11 Getestetes...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-62995 DESCRIPTION: joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWT...

CVE-2026-75573

CVE-2026-75573 affects mongodrdl , the data replication daemon in MongoDB Connector for BI . The root cause is that when a TLS private-key password is supplied both via the connection URI and the corresponding command-line option, mongodrdl may write that password to standard error . A local atta...

EUVD-2026-67084

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

CVE-2026-75573 MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

phpggc

PHPGGC: PHP Generic Gadget Chains PHPGGC is a library of unserialize payloads along with a tool to generate them, from command line or programmatically. When encountering an unserialize on a website you don't have the code of, or simply when trying to build an exploit, this tool allows you to...

phpggc

PHPGGC: PHP Generic Gadget Chains PHPGGC ist eine Bibliothek vonunserialize-Payloads sowie ein Werkzeug, um diese von der Kommandozeile oder programmatisch zu erzeugen. Wenn Sie auf einer Website auf ein unserialize stoßen, deren Code Sie nicht haben, oder einfach ein Exploit bauen möchten,...

ios-nehelper-enum-apps-0day

nehelper enumera le app installate 0-day iOS 15.0 Ho aggiornato questo codice per evitare di usare direttamente le API private. Leggi di più nel mio post del blog. Tuttavia, questo significa che ora il codice è specifico per la versione di iOS e possibilmente specifico per il modello di...

CVE-2007-2447

CVE-2007-2447 Exploit per Samba Un'implementazione autonoma in Rust dell'exploit CVE-2007-2447 che colpisce Samba smbd 3.0.20-Debian. Descrizione della vulnerabilità CVE-2007-2447 è una vulnerabilità di command injection nelle versioni di Samba dalla 3.0.0 alla 3.0.25rc3. La vulnerabilità risiede...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Sfruttamento RCE del Pannello Pterodactyl HTB Stagione 10 - Writeup della Macchina Pterodactyl Panoramica Target: Macchina HTB Pterodactyl Difficoltà Media CVE: CVE-2025-49132 Gravità: Critica CVSS 9.8 Tipo di Attacco: Esecuzione Remota di Codice Non Autenticata Affetto: Pannello...

gogs

gogs Qui allestiremo il nostro laboratorio nella VM SEED Ubuntu 16.04 e dobbiamo installare il Go Git Service GOGS sulla nostra VM prima di poter sfruttare la vulnerabilità di SQL injection. Per configurare la VM, ecco i passaggi: Passo 1: Installare il Database Una volta effettuato l'accesso al...

Rootsmart-v2.0

Rootsmart 2.0 mit cve-2019-2215 + Ransomware Haftungsausschluss Dieses Projekt dient ausschließlich Bildungszwecken. Dieses Projekt verwendet Code von rkshrksh/2048-Game und kangtastic/cve-2019-2215. Projektbeschreibung Dieses Projekt ist Teil des Moduls Mobile Security der Singapore Institute of...

xzwhy

xzwhy root@kitploit: / / / / \ / /\ Questo progetto è una Proof of Concept POC compatibile con Kubernetes per CVE-2024-3094, che interessa XZ Utils. Vedi questo articolo per un'ottima analisi dell'origine e del funzionamento dell'exploit. AVVERTENZA ⚠⚠⚠ L'esecuzione di uno qualsiasi dei comandi...

CVE-2024-25153

CVE-2024-25153 Questa è una proof of concept per CVE-2024-25153, una vulnerabilità di esecuzione remota di codice in Fortra FileCatalyst Workflow 5.x, prima della versione 5.1.6 Build 114. I dettagli tecnici completi sono disponibili su...

system_bt_AOSP10_r33_CVE-2020-0225

Fluoride Bluetooth stack Compilazione ed esecuzione su AOSP Basta compilare AOSP - Fluoride è presente per impostazione predefinita. Compilazione ed esecuzione su Linux Istruzioni per Ubuntu, testate su 14.04 con Clang 3.5.0 e 16.10 con Clang 3.8.0 Scarica il codice sorgente root@kitploit: mkdir...

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing...

CVE-2025-33073

CVE-2025-33073 PoC-Exploit für den NTLM-Reflection-SMB-Fehler. Alle Credits gehen an die offizielle Forschung: https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 Voraussetzungen Betriebssystem: Kali Linux hat die meisten...