CVE-2023-40028

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling. This PoC demonstrates how the exploit works under controlled conditions. Educational use only. Reference: Adapted from the original PoC by...

CVE-2024-24919-POC

CVE-2024-24919-POC A Simple tool to Automate CVE-2024-24919 Exposure of Sensitive Information Features Easy to Use. Helpful Comments; Can Test Multiple Domains Usage root@kitploit: git clone https://github.com/SubhankarX01/CVE-2024-24919-POC/ root@kitploit: cd CVE-2024-24919-POC; chmod +x...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Vulnerabilidad de almacenamiento en texto plano CVE-2023-5359 en W3 Total Cache Afecta a versiones ≤2.7.5 vulnerables a CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

CVE-2025-4679-SecureOAuth-Demo---Enfoque-educativo

🔐 OAuth Security Laboratory: CVE-2025-4679 Educational Simulator A safe, isolated environment to learn about OAuth vulnerabilities without risking real systems 🚀 Quick Start | 📚 Learning Path | 🛡️ Safe Environment | 👥 Contributors 📖 Overview This educational laboratory simulates the CVE-2025-4679...

CVE-2023-49367

CVE-2023-49367 - 敏感数据暴露 Kyocera 打印机 Web 面板中的敏感数据暴露 供应商：Kyocera Corporation 受影响版本：Command Center RX - EXOSYS M5521cdn 描述 连接至 Kyocera 接口地址簿后，可以在发送的数据包中看到针对 smb 和 ftp 的测试请求。这些请求包含明文密码，检查时可截获这些明文密码。 POC 转到 地址簿 页面 点击任意 已保存用户 对包含已输入数据的内容按下测试按钮 审查传入和传出的请求，查看明文密码数据...

sharingIsCaring

sharingIsCaring TwonkyMedia Server 被攻破 CVE-2018-7171 背景信息 这是一个 GitHub 仓库，保存了有关 CVE-2018-7171 的所有相关信息。（以及更多） CVE-2018-7171 是 TwonkyMedia Server 7.0.11-8.5（最新版本）中的一个目录/文件遍历漏洞。利用此漏洞，攻击者可以列出运行 TwonkyMedia Server 的设备上的所有文件，且与平台无关。此外，攻击者利用该漏洞后，可以从设备下载所有媒体文件（图片、视频和音乐）。要利用此漏洞，TwonkyMedia Server...

CVE-2026-76854

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7webauthusershow.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Description CVE-2023-5359 is a cleartext storage vulnerability affecting the WordPress plugin W3 Total Cache in versions ≤ 2.7.5. This vulnerability allows remote attackers to access sensitive credentials stored in unencrypted PHP fil...

CVE-2026-92255

Netcore NR255-V router version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi, caused by improper use of a string handling API that leads to an unterminated buffer over-read. An authenticated attacker (low privileges) over the network can trigger the flaw, pote...

CVE-2025-55182-react2shell

CVE-2025-55182: Exposed React Server Components RSC Detector This repository contains a Nuclei template for detecting React Server Components exposure associated with CVE-2025-55182. The vulnerability affects applications built with React/Next.js where the RSC negotiation layer is unintentionally...

CVE-2026-76857

Netcore NR255-V firmware version 1.5.130703 is affected by a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related components (DDNSset_cgi, IGD_GetCgiHandler, IGD_CgiCall). An authenticated low-privilege attacker who reaches this CGI handler can obtain ...

dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-88065

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

kygocera

kygocera CVE-2022-1026 Improved Golang Version of Rapid7 PoC for CVE-2022-1026 https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ credits to Aaron Herndon / https://twitter.com/ac3lives greets to https://github.com/D4RKMATT3R CVE-2022-1026 install...

CVE-2025-49132_poc

CVE-2025-49132poc Usage Examples 1. Scan a single target : root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. Scan a list of targets : root@kitploit: python3 CVE-2025-49132poc.py -f targets.txt 3. Save scan results : root@kitploit: python3 CVE-2025-49132poc.py -f...

CVE-2026-88065

tts-be is a backend service for a university timetable selector application. Versions prior to 2.1.0 contain a Broken Access Control vulnerability affecting multiple API endpoints, including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata. By chaining these unauthenticated end...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...