CVE_2021_27850_POC

Utilizzo dei comandi root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Supponendo che l...

Apache-Solr-Arbitrary-File-Read

Lettura Arbitraria di File in Apache Solr Hit Counter Apache Solr sta per Searching On Lucene with Replication è un motore di ricerca gratuito e open-source basato sulla libreria Apache Lucene. Scritto in Java. Apache Solr dispone di API RESTful XML/HTTP e JSON e di librerie client per molti...

cve-2019-6260

Uno strumento di test e debug per le interfacce AHB dei BMC ASPEED Avvertenza NON USARE QUESTO STRUMENTO SE NON HAI COMPRESO I SUOI COMPORTAMENTI NEL CONTESTO DELLA TUA MACCHINA TARGET. Questo strumento interviene su interfacce hardware e firmware di basso livello della tua macchina. In...

CVE-2020-2551

CVE-2020-2551 Weblogic RCE com IIOP 0x01 Ativação Padrão do IIOP 0x02 Demonstração PoC...

CVE-2020-0688

CVE-2020-0688 CVE-2020-0688Microsoft Exchange vulnerabilità di deserializzazione di default MachineKeySection Istruzioni di installazione: Scarica usando git Richiede git: git clone https://github.com/7heKnight/CVE-2020-0688 Scarica il file zip:...

CVE-2020-35590

Informazioni sull'Exploit Titolo Exploit: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Data: 2020-06-09 Autore Exploit: N4nj0 Link Software: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Versione: 2.13.0 Testato su: WordPress 5.4.1,...

CVE-2019-0232

استغلال CVE-2019-0232 تنفيذ التعليمات البرمجية عن بُعد RCE في CGI Servlet – Apache Tomcat على Windows المرجع : https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ root@kitploit: Apache Tomcat has a vulnerability in t...

CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

CVE-2023-27524: Apache Superset Authentifizierungsumgehung und RCE Apache Superset, ein weit verbreitetes Open-Source-Tool zur Datenvisualisierung und -erkundung, wurde mit potenziellen Sicherheitsschwachstellen identifiziert, die zu einer Authentifizierungsumgehung und Remote-Code-Ausführung RCE...

NoSQLMap

NoSQLMap NoSQLMap ist ein Open-Source-Python-Tool, das darauf ausgelegt ist, Injection-Angriffe zu auditieren und zu automatisieren sowie Standardkonfigurationsschwachstellen in NoSQL-Datenbanken und Webanwendungen, die NoSQL verwenden, auszunutzen, um Daten aus der Datenbank zu offenlegen oder z...

EUVD-2026-65699

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-16723

A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...

CVE-2023-45612-PoC

CVE-2023-45612 PoC Questa repository contiene una proof of concept PoC per CVE-2023-45612, che consentiva XXE nella configurazione predefinita di ContentNegotiation in ktor. La PoC è divisa in 2 parti: server/, contenente un esempio di server Ktor che utilizza una versione vulnerabile di Ktor, co...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

hekate

Hekate – Ein Exploit für Remote-Code-Ausführung in VMWare Workspace ONE Access Steven Seeley vom Qihoo 360 Vulnerability Research Institute Ursprünglicher rogue MySQL-Server von LandGrey Details Hekate wird als heh-ka-teh ausgesprochen Datum: Di 22. Feb 13:37:00 CST 2022 Version: 21.08.0.1...

evilgrade

Faraday Security Research -- | ISR-evilgrade | www.faradaysec.com | -- .:: BRIEF OVERVIEW ::. Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. It comes with pre-made binaries agents, a working default configuration...

PT-2026-81482

Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...

CVE-2023-27524

CVE-2023-27524 Configurazione predefinita non sicura in Apache Superset porta all'esecuzione remota di codice Schermata Requisiti Python3.7+ Sistemi operativi supportati Linuxer Wingays Per iniziare root@kitploit: $ git clone https://github.com/Pari-Malam/CVE-2023-27524 $ cd CVE-2023-27524 $...

CVE-2026-63563

CVE-2026-63563 - Modifica non autenticata della rubrica su multifunzione Sharp MX/BP Avviso del fornitore: Sharp Product Security Advisory 2026-004 pubblicato il 31 luglio 2026 Sintesi I multifunzione delle serie Sharp MX/BP espongono la rubrica tramite l'interfaccia web del dispositivo senza...