CVE-2023-6654

CVE-2023-6654 PHPEMS Cookie反序列化漏洞，利用此漏洞可以通过反序列化修改SQL语句，通过SQL注入修改任意存在用户的密码或权限，默认管理员账号为peadmin Fofa指纹 app="PHPEMS" 工具利用 python exp.py -u http://127.0.0.1:1111 -u 参数指定PHPEMS的URL地址 -a 参数指定用户名，默认为PHPEMS默认管理员账号peadmin -p 参数指定要修改的密码，默认为123456 -o 参数指定选项，0选项修改指定账号的密码，1选项修改指定账号的权限为管理员，默认修改指定账号的密码，不过还是推荐1选项...

Ubuntu-0day

Ubuntu16.04-0day 漏洞范围： all 4.4 ubuntu aws instances are vulnerable Jann Horn发现在某些情况下，Linux内核中的Berkeley Packet Filter（BPF）不正确地执行了符号扩展checkaluop。本地攻击者可以使用它在系统上进行提权,获取root权限。 root@kitploit: bpf: fix incorrect sign extension in checkaluop Distinguish between BPFALU64|BPFMOV|BPFK load 32-bit immediate...

EUVD-2026-70907

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-80438

CVE-2026-80438 affects the Ninja Forms WordPress plugin in versions 3.14.0 through 3.15.1 . The vulnerability stems from the plugin's REST abilities API not restricting access to full administrators; it accepts a Ninja Forms-specific capability as equivalent to full site administration. An attack...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

EUVD-2026-70902

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 - Falta de autorización para la actualización no autenticada de opciones arbitrarias Descripción El complemento Agency Toolkit para WordPress es vulnerable a la modificación no autorizada de datos que puede conducir a una escalada de privilegios debido a la falta de...

msiscan

MSI 分析器 这个用于 Linux 的 Python 脚本可以分析 Microsoft Windows .msi 安装程序文件并指出潜在漏洞。它由 Michael Baer @derbaer0 在 SEC Consult 漏洞实验室开发。 目前，它主要适用于本地权限提升，我们的博客文章中也对此进行了描述：https://r.sec-consult.com/msi。 Microsoft 分配了 CVE-2024-38014 ，并在 2024 年 9...

mindmanager-poc

mindmanager-poc 受影响应用程序：MindManager23setup.exe 平台：Windows 问题：通过 MSI 安装程序“修复”模式实现本地权限提升（EXE 劫持竞争条件） 发现并报告：Pawel Karwowski 和 Julian Horoszkiewicz（Eviden Red Team） 建议的缓解措施： https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi 公开披露的理由： 长期无限期搁置此问题，最终只会让威胁行为者受益（该问题极易被发现），同时让用户和管理员蒙在鼓里，对风险一无所知...

freemius-exploit

freemius-exploit Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Description The library, used in numerous plugins, does not have proper authorization when updating blog options, allowing any authenticated users, such as a subscriber, to update arbitrary options. Usage root@kitploit:...

CVE-2026-8181

💥 CVE-2026-8181 - Burst Statistics 认证绕过 通过 MainWP 认证绕过实现未认证权限提升 👨‍💻 作者...

CVE-2025-8045

CVE-2025-8045 — Arm Mali GPU KCPU Queue UAF A local privilege escalation exploit for CVE-2025-8045 , a use-after-free in the Arm Mali GPU kernel driver kbase. A non-privileged local process races the CSF KCPU queue dump path to free and reclaim a cpuqueue.buffer, turns the dangling allocation int...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page history.pushState'', '', '/'; document.forms0.submit; root@kitploit: "success":true,"data":"tempurl":"https://wp-dev.ddev.site?tempaccess=Osn6apJoSJunYNqOhDsn&userid=1","message":"Tempo...

CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

CVE-2017-8890

CVE-2017-8890 相关文档： ubuntu 内核双机调试方法 CVE-2017-8890漏洞分析和利用-概览篇 CVE-2017-8890 漏洞分析 原理篇 CVE-2017-8890 漏洞利用（root ubuntu 16.04@kernel 4.10） CVE-2017-8890 漏洞利用 root nexus6p@kernel 3.10...

CVE-2017-16995

CVE-2017-16995 记录一下自己折腾的CVE-2017-16995漏洞和相关分析 （希望能自己找个，笑 概述 此漏洞由于bpf虚拟执行时，校验器分支判断错误所引起的LPE 原理上是整数扩展漏洞 分析 触发 https://ph4ntonn.github.io/CVE-2017-16995-trigger.html 利用 https://ph4ntonn.github.io/CVE-2017-16995-exploit.html 结构 https://ph4ntonn.github.io/CVE-2017-16995-structure.html EXP 此处下载，请自行编译...

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472复现时使用的py文件整理打包 examples路径下为exp文件所在目录，其他为导入包，忽略即可 对应博客记录文章：https://www.svenbeast.com/post/fu-xian-cve-2020-1472-netlogon-te-quan-ti-sheng-lou-dong/...

CVE-2020-1472

Windows NetLogon 権限昇格脆弱性の再現（CVE-2020-1472） impacket.zipを現在のフォルダに解凍する必要があります。 最新のimpacketパッケージはこちらからダウンロードできます：https://github.com/SecureAuthCorp/impacket 具体的な手順は記事を参照：https://mp.weixin.qq.com/s/8rp0k5M2aPSPIXxVuIRMdQ 参考 https://github.com/dirkjanm/CVE-2020-1472...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...