CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

VulnCheck KEV: CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

Windows Exploitation Techniques: Dangling COM Object Registrations

Posted by James Forshaw This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug wa...

CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

UBUNTU-CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

UBUNTU-CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

CVE-2022-44877

Centos Web Panel 7 の未認証リモートコード実行 - CVE-2022-44877 root@kitploit: + Centos Web Panel 7 Unauthenticated Remote Code Execution + Centos Web Panel 7 - log ➜ CVE-2022-44877 cat log examplelog ➜ CVE-2022-44877 echo "examplelog $whoami" log ➜ CVE-2022-44877 cat log examplelog examplelog root ➜...

CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217-XStream-RCE-POC 예시 root@kitploit: package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\n" ...

dotnetpaddingoracle

dotnetpaddingoracle .NET Web アプリケーションが padding Oracle に対して脆弱かどうかをチェックする小さなスクリプトです。 このスクリプトは、パッチが適用されたかどうかだけでなく、オラクルが存在し悪用可能かどうかを実際に検証します。 使い方 root@kitploit: dotnetpaddingoracle.py -h -t -b -d -s -p PARAMETER Burp request file Perform the padding Oracle attack on .NET web application positional...

acltoolkit

acltoolkit acltoolkit は、ACL 悪用のためのスイスアーミーナイフ的なツールです。複数の ACL 悪用を実装しています。 目次 acltoolkit 目次 インストール 使い方 コマンド get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript インストール root@kitploit: pip install acltoolkit-ad または root@kitploit: git clone...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 online-shopping-system における SQL インジェクション online-shopping-system は、認証されていないエラーベース/ブールベースのブラインド SQL インジェクションおよびエラーベースの SQL インジェクション攻撃に対して脆弱です。 /homeaction.php ページの catid パラメータはユーザー入力をサニタイズしていないため、攻撃者は基盤となる MySQL データベースから機密データを抽出できます。 アプリケーションへのリンク online-shopping-syste...

CVE-2026-4480

🚨 CVE-2026-4480 - Critical Remote Code Execution in Samba Printing Subsystem Remote Code Execution RCE Samba Print Command Injection Vulnerability "A single print job name should never become a shell command." 📖 Overview CVE-2026-4480 is a critical command injection vulnerability affecting Samba'...

custom-bytecode-analyzer

custom-bytecode-analyzer JSON 규칙을 통해 사용자 지정이 가능한 Java 바이트코드 분석기입니다. 하나 이상의 Jar 또는 War 파일이 포함된 경로를 입력받아, 제공된 규칙을 사용하여 분석하고 결과를 HTML 보고서로 생성하는 명령줄 도구입니다. 사용법 root@kitploit: usage: java -jar cba-cli.jar OPTIONS -a DIRECTORYTOANALYZE -a,--analyze 분석을 실행할 디렉터리의 경로입니다. -c,--checks 분석에서 실행할 사용자 지정 검사...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2:...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

creepy-plugins

creepy-plugins Description Plugins for cree.py The architecture of cree.py allows for multiple user-defined sources for geolocation information. These sources are defined as plugins and can be installed in creepy by copying them into the plugins folder under the installation directory. New plugin...

creepy-plugins

creepy-plugins 説明 cree.py 用のプラグイン cree.py のアーキテクチャでは、複数のユーザー定義の位置情報ソースを利用できます。これらのソースはプラグインとして定義され、インストールディレクトリ内の plugins フォルダにコピーすることで cree.py にインストールできます。 新しいプラグイン 他のユーザーと共有したい場合は、新しいプラグインのプルリクエストを作成してください。確認後、リポジトリにマージします。 開発 cree.py のプラグインには少なくとも 3 つのファイルが必要です。 pluginname.yapsy-plugin...