2222 matches found
CPLDCOMTrigger
CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...
CPLDCOMTrigger
CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...
SecurityNotFound
404 Page Not Found Webshell 📼 Clone me! Clone or download the project: root@kitploit: git clone --depth=1 https://github.com/CosasDePuma/SecurityNotFound.git 📦 "Installation" The src/404.php file should be located on the target server and it must have the ability to execute .php files. Here is an...
cyberpanel
🛠️ CyberPanel 由 OpenLiteSpeed 驱动的网站托管控制面板，旨在简化托管管理。 🔧 功能与服务 🔐 不同用户访问级别 （通过 ACL 实现）。 🌌 自动 SSL ，为网站提供安全保护。 💻 FTP 服务器 ，用于文件传输。 🕒 轻量级 DNS 服务器 （PowerDNS）。 🔐 phpMyAdmin ，用于管理数据库（MariaDB）。 📧 电子邮件支持 （SnappyMail）。 🕌 文件管理器 ，方便快速访问文件。 🌐 PHP 管理 ，简单易用。 🔒 防火墙 （集成 FirewallD 与 ConfigServer Firewall）。 📀 一键备份与恢复 。 ...
silverboxcc
对名为 Red Alert V2.0 的安卓恶意软件进行了逆向工程。 分析时，已没有任何 C2 服务器在运行，因此我们无法观察到恶意软件与 C2 服务器之间的任何流量。 于是我们弄明白了 C2 协议，并编写了这个控制面板。 可以使用 iptables 重定向来自设备的 Bot 流量，使所有 Bot 通信都发送到我们的 C2 服务器。 root@kitploit: iptables -t nat -A OUTPUT -p tcp --dport -j DNAT --to-destination : 观看实际运行效果...
AhMyth-Android-RAT
AhMyth Android Rat Beta Version It consists of two parts : Server side : desktop application based on electron framework control panel Client side : android application backdoor Getting Started You have two options to install it 1 From source code Prerequisite : Electron to start the app Java to...
CVE-2023-41362_MyBB_ACP_RCE
CVE-2023-41362 - MyBB ACP RCE CVE-2023-41362 のエクスプロイト ブログ記事: https://blog.sorcery.ie/posts/mybbacprce...
cve-2020-0688
cve-2020-0688 cve-2020-0688 Inicia sesión con un usuario con privilegio de dirección de correo electrónico; no hay nada de qué preocuparse. Obtén - VIEWSTATEGENERATOR del código fuente de la página Obtén - el valor de la cookie ASP.NETSessionId para el valor viewstateuserkey Descargar YSO aquí...
CVE-2026-36670
CVE-2026-36670 针对 OpenSIPS 控制面板 的基于时间的盲 SQL 注入利用工具。 此漏洞利用程序利用了 OpenSIPS 中 aliasmanagement.php 模块的一个经过身份验证的 SQL 注入漏洞。table GET 参数未经过正确过滤，允许攻击者注入精心构造的派生表负载。 先决条件 Python 3.x requests 库（pip install requests） 后利用 该漏洞利用程序会转储管理用户的 ha1 哈希值。这些哈希值以 md5username:password 格式存储。你可以使用 hashcat 轻松破解它们：...
CVE-2026-85591
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 through before 5.10.11 are affected by a stored cross-site scripting (XSS) vulnerability in the site name field . The root cause is a failure to sanitize input in that field, allowing privileged administrators to inject arbitrary JavaScript payloads that execute ...
CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
EUVD-2026-69905
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...
CVE-2026-84792
Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...
PT-2026-84674
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
