CVE-2019-11510_poc

CVE-2019-11510 PoC 用于利用CVE-2019-11510并读取'/etc/passwd'文件的Python脚本 Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - 任意文件泄露漏洞 root@kitploit: USAGE: python3 CVE-2019-11510.py...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 描述 该脚本自动化利用 CVE-2024-24919 （Checkpoint 安全网关未经授权信息泄露）。 📌 功能特点 ✅ 单个和批量 URL 测试 ✅ 自动化利用 ✅ 简单快速 🛠️ 使用方法 克隆此仓库并运行脚本： root@kitploit: git clone https://github.com/spider00009/CVE-2024-24919-POC.git cd CVE-2024-24919-POC python exploit.py -u https://target.com...

ktor-xxe

ktor-xxe Ejecuta el proyecto con : | ./gradlew run | Ejecuta el servidor | Si el servidor se inicia correctamente, verás la siguiente salida: root@kitploit: 2024-12-04 14:32:45.584 main INFO Application - Application started in 0.303 seconds. 2024-12-04 14:32:45.682 main INFO Application -...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052，ClamAV 的 DMG 文件解析器中的信息泄露漏洞 用法 创建恶意 DMG 文件 root@kitploit: git clone https://github.com/nokn0wthing/CVE-2023-20052.git cd CVE-2023-20052 sudo docker build -t cve-2023-20052 . sudo docker run -v $pwd:/exploit -it cve-2023-20052 bash genisoimage -D -V "exploit" -no-pad -...

CVE-2026-92600

Guns (a Java-based application framework) through version 8.3.5 contains an information disclosure vulnerability in SysUserController . The /sysUser/detail and /sysUser/page endpoints omit the requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authent...

cve-2018-9995

cve-2018-9995 DVR，全称为Digital Video Recorder硬盘录像机，即数字视频录像机，相对于传统的模拟摄像录像机，采用硬盘录像，故常常被称为硬盘录像机，也被称为DVR. 通过漏洞允许攻击者通过修改“Cookie: uid=admin” 之后访问 DVR 的控制面板，返回此设备的明文管理员凭证。 使用方法: python3 cve-2018-9995.py...

CVE-2018-15473

CVE-2018-15473 SSH用户名枚举漏洞利用 OpenSSH 2.3 7.7 原始漏洞利用代码的编辑版本：https://www.exploit-db.com/exploits/45233 已转换为Python3 添加了用户名词表选项 如何运行 root@kitploit: Ensure that you install the requirements: foo@bar:$ pip3 install -r requirements.txt root@kitploit: For single username: foo@bar:$ ./CVE-2018-15473.py...

Blackash-CVE-2025-24071

Blackash-CVE-2025-24071 CVE-2025-24071：通过 .library-ms 文件泄露 NTLM 哈希的 Metasploit 模块 🚨 描述 Windows 文件资源管理器将敏感信息暴露给未经授权的攻击者，使得未经授权的攻击者可以通过网络进行欺骗。 指标 CNA：Microsoft 公司 基础得分：6.5 中等 🟠 向量：CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 概述 当用户解压包含特制 .library-ms 文件的 ZIP 压缩包时，漏洞便会触发。Windows 资源管理器会自动向文件中指定的远程服务器发...

mongobleed-exploit-CVE-2025-14847

🩸 MongoBleed - CVE-2025-14847 安全研究实验室 CVE-2025-14847 | CVSS 8.7（高危）| 未认证内存泄露 📖 完整文档 • 🔬 技术分析 • ⚡ 快速命令 🎯 CVE-2025-14847 概述 MongoBleed 是 MongoDB 网络传输层中的一个严重内存泄露漏洞，允许未认证的远程攻击者 无需任何凭据或用户交互，即可窃取敏感的堆内存数据。 影响 类别| 描述 ---|--- 攻击类型| 远程未认证内存泄露 根本原因| zlib 解压返回分配的缓冲区大小，而非实际数据长度 泄露的数据| 数据库密码、API 密钥、会话令牌、AWS...

CVE-2014-4378

CoreGraphics 信息泄露 - CVE-2014-4378 本文探讨了在 IOS 7.1.x 上利用 MobileSafari 的可能性。通过将精心制作的 PDF 文件用作 HTML 图像，可以将内存布局信息泄露给浏览器 Javascript 解释器。Apple CoreGraphics 库在解析嵌入 PDF 内容流中的内联图像的色彩空间规范时未能验证输入。该问题导致信息泄露漏洞，增强了攻击者利用与此库链接的任何应用程序中的其他漏洞的能力。这也被证明有助于绕过多种漏洞缓解措施，如 ASLR、DEP 和代码签名。 摘要： 标题: Apple CoreGraphics 信息泄露 CV...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2025-67223

CVE-2025-67223: Incorrect Access Control & Information Disclosure in Aranda Service Desk CVE ID: CVE-2025-67223 Affected Product: Aranda Service Desk Aranda File Server - AFS module Affected Versions: 8.3.12 Author: Brandon Perez Lara 🚨 Overview A critical vulnerability was identified in the file...

CVE-2025-24071-POC-NTLMHashDisclosure-

CVE-2025-24071-POC-NTLMHashDisclosure Triggers automatic SMB authentication to an attacker-controlled share. No interaction required — Windows Explorer initiates this NTLM authentication automatically. Results in NTLMv2 hash leakage information disclosure. Affects Windows 10/11 all versions,...

WordPress-Exploit-CVE-2024-1071

WordPress CVE 2024-1071 SQL 漏洞利用 该漏洞利用程序针对 WordPress 2.1.3 到 2.8.2 版本，允许未经认证的攻击者向现有查询中添加额外的 SQL 查询，从而从数据库中提取敏感信息。 Dork: body="/wp-content/plugins/ultimate-member" 1 git clone https://github.com/Dogu589/WordPress-Exploit-CVE-2024-1071.git cd WordPress-Exploit-CVE-2024-1071 2 python3...

EUVD-2026-80851

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...