CVE-2026-73171

Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a...

CVE-2026-73171

Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a...

CVE-2026-73170

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a...

CVE-2026-73170

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a...

CVE-2026-73170

Nozomi Networks Labs identified a CWE-94 Code Injection vulnerability in the Modbus CSV import workflow of the Advantech EKI-1242EIMS industrial Ethernet switch running firmware V1.06.01 . A remote authenticated attacker can craft a malicious imported file to achieve arbitrary Lua code execution ...

EUVD-2026-80730

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a...

Security Bulletin: Multiple vulnerabilities impact AIX due to ISC BIND

Summary Vulnerabilities in ISC BIND could cause: Allowing forged authenticated NXDOMAIN responses CVE-2026-10723, Denial of service CVE-2026-10822, CVE-2026-11331, CVE-2026-11622, CVE-2026-12617, CVE-2026-13204, DNS cache poisoning CVE-2026-11721, CVE-2026-13321. AIX uses ISC BIND as part of its...

analyze-Exploit-CVE-2023-22518-Confluence

Exploit-CVE-2023-22518 CVE-2023-22518 en Confluence CVE-2023-22518 : Esta vulnerabilidad se describe como “vulnerabilidad de autorización incorrecta en la base de datos y el servidor de Confluence”. El fallo afecta a las versiones On-premises de los productos de Atlassian. CONFIGURACIÓN Configura...

trivy-plugin-attest

trivy-plugin-attest Publicar atestación de SBOM Instalación root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest Uso root@kitploit: A Trivy plugin that publish SBOM attestation Usage: attest flags Examples: trivy attest --type PREDICATETYPE --predicate PREDICATEPATH...

CVE-2026-92247

SynaptikCMS File Manager — RCE Autenticado Vulnerabilidad Ejecución Remota de Código Autenticada en el Gestor de Archivos de SynaptikCMS El gestor de archivos de SynaptikCMS permite a un atacante autenticado subir un archivo y posteriormente renombrarlo a un archivo PHP. Este comportamiento de...

samsung-q60t-exploit

Exploit de Tizen Descripción Script de exploit y descifrado de firmware presentado en Grehack 2021. Las diapositivas están disponibles dentro del directorio slides . y el video de la repetición enYoutube . Directorios Este repositorio contiene tres directorios: exploit/: contiene el exploit de v8...

lumina_server

About POC of an offline server for IDA Lumina feature. More details on https://www.synacktiv.com/publications/investigating-ida-lumina-feature.html Instalation Python package installation Download project and run python lumina/setup.py or pip install .. Server can also be used as a standalone...

php_filter_chains_oracle_exploit

Cadenas de filtros PHP: lectura de archivos desde un oráculo basado en errores Una CLI para explotar parámetros afectados por la lectura de archivos causada por el oráculo basado en errores de las cadenas de filtros PHP. Puede utilizarse para filtrar el contenido de un archivo local cuando se pas...

keebcap

Keebcap Este repositorio contiene el código asociado a este artículo en el que hablamos sobre la creación de un keylogger win32 que admite todos los idiomas que no utilizan editores de métodos de entrada. Todas las pruebas se realizaron en Windows 10 22h2. árbol root@kitploit: . keylog code ├──...

mobileiron-exploit

Exploit de Tabshell con autenticación Kerberos Adaptado de la cadena de exploits OWASSRF + TabShell Primero, parchea el módulo pyprsp para habilitar la degradación de WSManStackVersion, e instala las dependencias root@kitploit: $ git clone https://github.com/jborean93/pypsrp $ patch -p0...

CVE-2024-10586-Poc

漏洞信息 描述 WordPress的Debug Tool插件在所有版本直至2.2中存在一个漏洞，由于dbtpullimage函数缺少权限检查以及文件类型验证缺失，导致未经身份验证的攻击者可以创建任意文件（如.php文件），进而实现远程代码执行。 CVE ID CVE-2024-10586 脚本使用方法 先决条件 系统中已安装Python 3.x。 安装所需依赖： pip install requests 运行方式 1. 从GitHub克隆仓库： root@kitploit: git clone https://github.com/Nxploited/CVE-2024-10586-Poc...

EUVD-2026-80738

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...

CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...

CVE-2026-92360

A medium-severity vulnerability (CVSS 3.1: 6.3 ) exists in ag-ui-protocol ag-ui 1.0 , specifically in the Event Application Layer component. The vulnerable element is the prepareRunAgentInput function in agent/agent.ts , where manipulation of the TEXT_MESSAGE_START argument triggers an origin val...

CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...