IngressNightterror

IngressNightterror CVE-2025-1974 Overview This repository is my research on IngressNightmare vulnerability. It includes a vulnerable Ingress deploy files, exploit itself and shared object payload. CVE The list of CVE indexes: CVE-2025-1974 - Root vulnerability CVE-2025-24514 - auth-url annotation...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

CVE-2026-100859

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

Apache Solr - Deserialization of Untrusted Data

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. id:...

DataTaker DT80 dEX 1.50.012 - Information Disclosure

DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/o...

pyLoad Flask Config - Access Control

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. id: CVE-2024-21644 info: name: pyLoad Flask Config ...

MSNSwitch Firmware MNT.2408 - Authentication Bypass

MSNSwitch Firmware MNT.2408 is susceptible to authentication bypass in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh. An attacker can arbitrarily configure settings, leading to possible remote code execution and subsequent unauthorized operations. id: CVE-2022-32429 info: name:...

CVE-2023-23752

CVE-2023-23752 Joomla! Unauthorized Access Vulnerability POC: /api/index.php/v1/config/application?public=true Vulnerability Analysis https://xz.aliyun.com/t/12175...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-78306

CVE-2026-78306 — DJI DUML Command Injection over Bluetooth POC Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchange Wi-Fi credentials. The Bluetooth interface checks the device's trusted UUID for three commands: Get SSID Ge...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

CVE-2026-31309

CVE-2026-31309: Improper Access Control in Mysterium Node before v1.36.0 Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node...

CVE-2023-31852

CVE-2023-31852 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/config has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2021-36749

CVE-2021-36749 Apache Druid Arbitrary File Read Affected versions: version = 0.21.1 Either of the following two methods can be used Command Line Method root@kitploit: curl http://127.0.0.1:8888/druid/indexer/v1/sampler?for=connect -H "Content-Type:application/json" -X POST -d...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

EUVD-2026-87762

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...

CVE-2025-8110

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Disclaimer: This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test. This is a modified version of zAbuQasem/gogs-CVE-2025-8110, adapted to work...

spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...