Pachine

Pachine Implémentation Python pour CVE-2021-42278 Élévation de privilèges Active Directory. Installation root@kitploit: $ pip3 install impacket Utilisation root@kitploit: Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE...

CVE-2023-31717

CVE-2023-31717 It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND...

GHSA-653Q-5476-X79G Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

EUVD-2026-62604

Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli...

NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

CVE-2026-82024

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 SQL-инъекция в Online-Food-Ordering-Web-App Online-Food-Ordering-Web-App уязвима к неаутентифицированным атакам с использованием ошибок и time-based blind SQL-инъекций. Параметр username на странице /login.php не санитизирует пользовательский ввод, поэтому атакующий...

aws-security-assessment-solution

셀프 서비스 보안 평가 솔루션 v2.0 사이버 보안은 많은 CIO, CISO 및 그들의 고객에게 매우 중요한 주제이자 관심사로 남아 있습니다. 이러한 중요한 우려 사항을 해결하기 위해 AWS는 고객이 계정을 보호하는 데 도움이 되는 기본 서비스 세트를 개발했습니다. Amazon GuardDuty, AWS Security Hub, AWS Config 및 AWS Well-Architected 리뷰는 고객이 AWS 계정에 대한 강력한 보안 태세를 유지하는 데 도움이 됩니다. 더 많은 조직이 클라우드로 이전함에 따라, 특히 빠르게...

Exploit for CVE-2026-65643

CVE‑2026‑65643 – cPanel Domain Parking RC...

dp_crypto

dpcrypto Exploit d'oracle de chiffrement basé sur Base64 pour CVE-2017-9248 gestionnaire de dialogue Telerik UI for ASP.NET AJAX Publié sur exploit-db Mise à jour 2020 - Veuillez noter que la version sur exploit-db est maintenant très obsolète par rapport à la dernière version ici sur GitHub...

CVE-2026-82526 R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...

CVE-2026-82526

R2R (SciPhi-AI) through 3.6.6 contains a stacked SQL injection in the vector index creation endpoint. The index name parameter is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, allowing unauthenticated attackers to exe...

EUVD-2026-70653

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...

cve-2022-33891

cve-2022-33891 Usage: root@kitploit: pip3 install requests If you do not use the -d parameter, the dnslog domain name will be automatically applied for you. 如果你不使用-d参数，则会自动为您申请dnslog域名。 python3 cve202233891poc.py -u http://127.0.0.1 python3 cve202233891poc.py -f url.txt python3 cve202233891poc.py...

redamon

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

GHSA-6437-GXHQ-PQV8 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

EUVD-2026-62602

Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client...

NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...