CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - 未认证的SQL注入 via orderby 参数 描述 Events Manager – Calendar, Bookings, Tickets, and more! WordPress插件存在基于时间的SQL注入漏洞，漏洞位于'orderby'参数中，影响所有版本至7.0.3（含）。由于对用户提供的参数转义不足，且对现有SQL查询缺乏充分的预处理，未认证攻击者可以将额外的SQL查询附加到已有查询中，从而从数据库中提取敏感信息。 详情 类型 : 插件 Slug : events-manager 受影响版本 :...

DragonCastle

DragonCastle 一个概念验证（PoC），将 AutodialDLL 横向移动技术与 SSP 相结合，从 LSASS 进程中提取 NTLM 哈希。 描述 将 DLL 上传到目标机器。然后启用远程注册表以修改 AutodialDLL 条目，并启动/重启 BITS 服务。Svchost 进程将加载我们提供的 DLL，将 AutodialDLL 重新设置为默认值，并通过 RPC 请求强制 LSASS 将同一个 DLL 作为安全支持提供程序（SSP）加载。 一旦 LSASS 加载了该 DLL，它会在进程内存中搜索，提取 NTLM 哈希以及密钥/IV。 DLLMain 始终返回...

ssh3

!NOTE SSH3 probablemente cambiará de nombre. Sigue siendo el Protocolo de Conexión SSH RFC4254 ejecutándose sobre HTTP/3 Extended Connect, pero los cambios necesarios son significativos y demasiado alejados de la filosofía de las implementaciones populares de SSH como para considerar su...

manul

Manul Manul is a coverage-guided parallel fuzzer for open-source and black-box binaries on Windows, Linux and macOS beta written in pure Python. Quick Start root@kitploit: pip3 install psutil git clone https://github.com/mxmssh/manul cd manul mkdir in mkdir out echo "AAAAAA" in/test python3...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-50022

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

Extractor

Instrucciones de instalación para quienes no quieran compilar por sí mismos: 1. Descargue la librería GSON de Google desde Maven http://central.maven.org/maven2/com/google/code/gson/gson/2.8.2/gson-2.8.2.jar wget http://central.maven.org/maven2/com/google/code/gson/gson/2.8.2/gson-2.8.2.jar 2. En...

fips203

NCC Group: Estándar de Mecanismo de Encapsulación de Claves Basado en Retículos Modulares FIPS 203 El FIPS 203 Borrador Público Inicial Estándar de Mecanismo de Encapsulación de Claves Basado en Retículos Modulares está escrito en Rust puro para aplicaciones de servidor, escritorio, navegador y...

wordpress-cve-2024-10924-pentest

WordPress CVE-2024-10924 渗透测试报告 Really Simple SSL 插件中的 2FA 绕过漏洞 📋 目录 执行摘要 目标信息 方法论 时间线 侦察阶段 漏洞分析 攻击流程 利用 影响评估 修复建议 所用工具 参考资料 附录 🎯 执行摘要 目标： https://skior.co 漏洞： CVE-2024-10924 - Really Simple SSL 插件中的 2FA 绕过 严重性： 严重（CVSS 评分：9.8） 状态： 已成功利用 发现日期： 2025-06-25 报告版本： 2.1...

Security Bulletin: IBM MQ for HPE NonStop is affected by vulnerabilities in OpenSSL

Summary IBM MQ for HPE NonStop is affected by OpenSSL vulnerabilities CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-7383,...

test_avb_key

Sobre casi firmar builds de Android Introducción Un error que a veces encuentran los consultores de NCC Group es firmar builds de Android con claves privadas conocidas. Esto deja a los fabricantes de dispositivos y, por lo tanto, a sus usuarios vulnerables, incluso en dispositivos donde el arranq...

Exploit for Improper Input Validation in Linuxfoundation Spinnaker

CVE-2026-32604 - Spinnaker GitRepo Artifact RCE CVE-2026-...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

blogpost_cve-2018-19987-analysis

CVE-2018-19987（D-Link 操作系统命令注入）分析 大家好！ 在这篇简短的博客文章中，我将详细拆解我所进行的一项快速分析，以更好地理解 CVE-2018-19987 背后的细节。起初我追踪这个 CVE 是因为我以为没有任何公开信息或漏洞利用。在进行初步分析后不久，我在 GitHub 上找到了两个公开的 PoC，你可以在这里和在这里找到它们。 由于我已经完成了大部分工作，并且没有找到完整的分析，我决定无论如何都要写这篇博客文章。 希望你喜欢！ 更新： 好吧……当我在这篇博客文章中遇到困难并进行谷歌搜索时，我发现了下面这篇文章，它描述了 D-Link DIR-818...

EUVD-2026-82470

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597

ITFlow , an IT documentation and ticketing system for managed service providers, is vulnerable to an authenticated time-based blind SQL injection via the expires GET parameter in the share_generate_link handler of agent/ajax.php. The root cause is that sanitizeInput applies string-context escapin...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...