CVE-2025-49132_poc

CVE-2025-49132poc Verwendungsbeispiele 1. Einzelnes Ziel scannen : root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. Zielliste scannen : root@kitploit: python3 CVE-2025-49132poc.py -f zielliste.txt 3. Scanergebnisse speichern : root@kitploit: python3...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ Über Ein Python-Skript , das die Erkennung und Ausnutzung von Sicherheitslücken in falsch konfigurierten Pterodactyl -Panels automatisiert. 🔍 Erkennt die Offenlegung sensibler Konfiguration Datei locale.json. 🔑 Extrahiert...

EUVD-2026-64745

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS RCE autenticato Uno script Python 3 che carica un file tasks.pickle che abilita RCE in MotionEye. Servono credenziali di amministratore, quindi non dovrebbe essere un grosso problema. Sfortunatamente, MotionEye/MotionEyeOS può essere trovato spesso in esecuzione con...

CVE-2026-81691

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81093

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-78251

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2022-35513

blink1-pass-decrypt ⭐ poc e script semplice progettato per decifrare il ciphertext trovato in /blink/input del server api nelle installazioni blink1control2 versioni =2.2.7. l'exploit - CVE-2022-35513 ❗ l'app blink1control2 utilizza una crittografia debole delle password e un metodo di...

CVE-2020-24227

CVE-2020-24227 Playground Sessions - Memorizzazione delle credenziali utente in chiaro Playground Sessions v2.5.582 e versioni precedenti per Windows memorizza le credenziali utente in testo semplice, consentendo a chiunque abbia accesso a C:\Users\AppData\Roaming\Playground\Local...

CVE-2021-21389

Verwendung 1. Baue das Docker-Image, um eine verwundbare WordPress- und BuddyPress-Umgebung einzurichten. 2. Baue und starte den MariaDB-Container. 3. Stelle sicher, dass beide Container im selben Netzwerk ausgeführt werden. z.B. docker network create wordpressnetwork docker network connect...

EUVD-2026-67047

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81093

Apify Actors MCP Server before version 0.9.12 is vulnerable to Server-Side Request Forgery (SSRF) via the get-html-skeleton tool. The URL validation function (isValidHttpUrl) in src/utils/generic.ts confirmed only that the argument began with an http/https scheme and parsed as a URL, without insp...

CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2019-18988

CVE-2019-18988 Entschlüsselung gespeicherter TeamViewer-Anmeldeinformationen...

CVE-2022-3656

Il Red Team di Imperva ha recentemente rivelato una vulnerabilità chiamata CVE-2022-3656 che colpisce più di 2,5 miliardi di utenti di Google Chrome e dei browser basati su Chromium. Questa vulnerabilità consente il furto di file sensibili, come portafogli crittografati e credenziali di provider...

SharpSCOM

SharpSCOM Uno strumento C per interagire con Microsoft System Center Operations Manager SCOM. Questo strumento è stato testato con il server SCOM versione 10.22.10118.0. L'integrazione SSPI è fornita tramite la libreria nsspi di Kevin Thompson antiduh, rilasciata sotto licenza BSD-2. Utilizzo da...

sickrageWTF

Credenziali GitHub in chiaro di Sickrage CVE-2018-9160 1. Informazioni Titolo dell'exploit: Credenziali in chiaro di SickRage nella risposta HTTP Data: 2018-04-01 Autore dell'exploit: Sven Fassbender Contatto: https://twitter.com/mezdanak Homepage del fornitore: https://sickrage.github.io Link de...

CVE-2023-26258-ArcServe

Das TL; DR; Wenn du im Netzwerk bist, kannst du mit ArcServeRadar.py nach standardmäßig konfigurierten Instanzen scannen. Ich habe versucht, es nach C zu portieren, aber es nicht geschafft – wenn du weißt, wie es geht, kannst du das gerne tun : root@kitploit: c:\Users\vagrant\Desktoppython...

CVE-2022-41678

CVE-2022-41678: MBeans Pericolosi Accessibili tramite API Jolokia in Apache ActiveMQ Elencando e ispezionando gli MBeans esposti dall'API Jolokia all'indirizzo http://127.0.0.1:8161/api/jolokia sono stati identificati i seguenti vettori d'attacco: Scrittura Arbitraria di File tramite Log4J che...