ADSearch

ADSearch 一个为 cobalt-strike 的 execute-assembly 命令编写的工具，用于更高效地查询 AD。 主要功能 列出所有域管理员 自定义 LDAP 搜索 连接到 LDAPS 服务器 从 AD 实例输出 JSON 数据 从通用查询中检索自定义属性（例如所有计算机） 用法 root@kitploit: ADSearch 1.0.0.0 Copyright c 2020 USAGE: 远程或本地查询 Active Directory： ADSearch --domain ldap.example.com --password AdminPass1...

Inline-Execute-PE

Inline-Execute-PE 免責事項: このプロジェクトは複雑であり、仕組みを理解せずに適切にテストしないと、Beacon がクラッシュしてアクセスを失う可能性があります。 「設計上の考慮事項と解説」セクションまでのすべてのドキュメントを読むことを強くお勧めします。 はじめに Inline-Execute-PE は、Beacon Object File（BOF）と、CobaltStrike 用の Aggressor スクリプトのスイートです。これにより、オペレーターはアンマネージド Windows 実行可能ファイルを Beacon メモリにロードして実行し、出力を取得して...

D-Link - Remote Command Execution

A Remote Command Execution RCE vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file id: CVE-2021-45382 info: name: D-Link - Remote Command Execution author: king-alexander severity: critic...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

VvvebJs < 1.7.5 - Arbitrary File Upload

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php. id: CVE-2024-29272 info: name: VvvebJs 1.7.5 - Arbitrary File Upload author: s4e-...

mooSocial v.3.1.8 - Cross-Site Scripting

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...

Jan v0.4.12 - Arbitrary File Upload

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-36858 info: name: Jan v0.4.12 - Arbitrary File Upload author: pussycat0x severity: critical description: | An arbitrar...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

CVE-2022-39196-

CVE-2022-39196 Black board CMS 权限提升 Blackboard Learn 1.10.1 版本允许远程认证用户通过输入学生凭证并直接访问特定 webapps/bbcms/execute/ URL 来读取非预期的文件。 附加信息 root@kitploit: 步骤1：使用学生凭证权限。用户名： 及密码： 进行登录。 步骤2：使用"学生"账户权限成功登录后。 步骤3：然后请求"漏洞的URL/位置"。 步骤4：无需任何权限要求，直接将会话从"学生"提升为"竞赛管理系统"权限。 漏洞类型 root@kitploit: 敏感数据泄露 产品供应商...

CVE-2025-9223

Applications Manager - Execute Program Action Bypass PoC 📖 描述 本仓库包含一个概念验证（PoC），演示了 ManageEngine Applications Manager 中"Execute Program Action"功能存在的命令执行漏洞。 🔍 漏洞详情 Applications Manager 使用黑名单（BlackListCommands）来阻止危险命令，但验证存在严重缺陷： 基于字符串的验证 仅针对第一个令牌（token） 缺少路径规范化 或环境变量扩展 缺少防护 ，无法阻止通过脚本进行间接执行 🚨 绕过方法...

CVE-2018-17961

构建镜像 使用端口转发运行容器 通过 ssh -X 进入其中 运行 evince executeonlybypass.ps 检查漏洞利用是否已写入 /.bashrc...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

RedPersist

RedPersist RedPersist は C で書かれた Windows 永続化ツールです。 プロジェクトのコンパイル このプロジェクトでは以下のサードパーティライブラリを使用しています。 TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Visual Studio プロジェクトを開き、「ツール」「NuGet パッケージ マネージャー」「パッケージ マネージャー設定」に移動します。 「NuGet パッケージ マネージャー」「パッケージ ソース」を開きます。...

idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

CVE-2026-19958

The CVE concerns iatsiuk pptr-mcp up to 0.2.7. Affected component is the execute Tool’s file src/vm-executor.ts, function executeCode, where manipulation enables code injection. Impact is exposed via a remote attack with public exploit availability; CVSS data indicates MEDIUM severity with networ...

PT-2026-73173

Name of the Vulnerable Software and Affected Versions iatsiuk pptr-mcp versions prior to 0.2.8 Description A flaw in the execute Tool component allows for remote code injection. The issue resides within the executeCode function located in the src/vm-executor.ts file. Recommendations At the moment...

CVE-2026-74464 net: openvswitch: fix skb leak on flow key update failure during ct

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...

CVE-2026-14673

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

EUVD-2026-57420

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...