CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

Escalade de privilèges CA Common Services CVE-2016-9795 revisitée Description Lors d'un de mes tests d'intrusion, je suis tombé sur le binaire SUID casrvc qui fait partie de la suite CA Common Services. Comme je l'ai découvert, le binaire est vulnérable à une escalade de privilèges locale. En...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder RCE non authentifié SP Page Builder comsppagebuilder pour Joomla ≤ 6.6.1 permet à des attaquants non authentifiés de téléverser des fichiers arbitraires et d'obtenir une exécution de code à distance. Champ| Valeur ---|--- CVE| CVE-2026-48908 CWE| CWE-284 Contrôle...

Dorkwright

Dorkwright - Strumento per Google Dorking Dorkwright è un potente strumento Python per Google dorking che automatizza l'estrazione di collegamenti a file dai risultati di ricerca Google e, opzionalmente, li scarica. Utilizza Playwright per l'automazione del browser e include gestione CAPTCHA,...

CVE-2024-21626-old-docker-versions

Containeraustritt-Schwachstelle in alten runc-Komponenten CVE-2024-21626 Während meiner Analyse zu CVE-2024-21626 habe ich festgestellt, dass andere ältere Docker-Komponenten anfällig für fd-Leaks sind was in der Sicherheitswarnung GHSA-xr7r-f8xq-vfvv nicht erwähnt wird. Lesen Sie meinen...

Jenkins-CVE-2024-23897-

Use o comando:python 3 CVE-2024-23897 . py-l 2 . txt-f/etc/passwd escreva o URL Uniform Resource Locator em 2.txt para processamento em lote...

magic-extractor

Magic Extractor Descrizione Magic Extractor è uno strumento di estrazione universale per Windows che identifica un file con diversi rilevatori e lo instrada verso il giusto estrattore incluso. Mira a coprire i formati di compressione principali, gli installatori che si vedono oggi, e una gamma di...

php_filter_chain_generator

مولّد سلسلة فلاتر PHP أداة سطر أوامر لتوليد سلسلة فلاتر PHP؛ احصل على RCE دون رفع ملف إذا كنت تتحكم بالكامل في المعامل المُمرَّر إلى require أو include في PHP! الاستخدام المساعدة root@kitploit: $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain CHAIN...

EUVD-2026-66804

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

EUVD-2026-66802

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

EUVD-2026-66764

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Écriture Arbitraire de Fichier vers RCE – Processus de Déduction et Réflexions Périmètre d'application : Utilisation uniquement sur des environnements de test locaux, des environnements de reproduction autorisés, pour la validation de...

HiveV5_file_decryptor

PoC del decrittatore di file HiveV5 Introduzione Il lavoro svolto negli ultimi mesi è stato necessario per rivelare il meccanismo di cifratura dei file dannoso di Hive v5-5.2. Il lavoro è stato suddiviso in due parti 1. Decrittazione del keystream 2. Decrittazione dei file utilizzando il keystrea...

vm-filesystem

vm-filesystem Ein Firebeam-Bytecode zur Dateisysteminteraktion, der gleichzeitig die Python-Funktion für die Havoc-Schnittstelle des Dateibrowsers monkey-patched, um die Interaktion mit dem entfernten Dateisystem zu ermöglichen, ohne dass das Dateisystem eingebettet sein muss. Dieses Repository...

rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

pwnlift

pwnlift Nomeado em homenagem ao pwndrop, o pwnlift é um aplicativo de servidor dotnet simples para enviar arquivos de um desktop sem o uso de um C2. Útil se você tiver acesso ao console de uma máquina e precisar retirar arquivos offline para análise como arquivos de Política de Integridade de...

CVE-2015-6967-EXPLOIT

CVE-2015-6967-EXPLOIT CVE-2015-6967 PoC Exploit Dieses Python-Skript nutzt eine Schwachstelle in Nibbleblog CVE-2015-6967 aus, um eine Reverse-Shell auf ein verwundbares Ziel hochzuladen. Das Skript nimmt Benutzereingaben für die Ziel-URL, Benutzeranmeldedaten und Ihre Host-IP/Port entgegen und...

CVE-2025-67223

CVE-2025-67223: Aranda Service Desk में गलत पहुँच नियंत्रण और सूचना प्रकटीकरण CVE ID: CVE-2025-67223 प्रभावित उत्पाद: Aranda Service Desk Aranda File Server - AFS मॉड्यूल प्रभावित संस्करण: 8.3.12 लेखक: Brandon Perez Lara 🚨 अवलोकन Aranda Service Desk के फ़ाइल प्रबंधन मॉड्यूल Aranda File Server में...

PULSE-C2

Framework PULSE C2 Infrastruttura di Comando e Controllo HTTPS con dashboard web per la gestione remota di agenti Windows. ⚠️ Solo per uso educativo - L'uso illegale è di tua responsabilità. Caratteristiche Server C2 HTTPS con crittografia TLS Flask Dashboard web in tempo reale Protocollo...

cve-2021-44228-log4j-test

cve-2021-44228-log4j-test Test 1. LDAP-Server und Download-Server für Schadcode-Dateien 1.1 Docker-compose ausführen docker-compose.yml root@kitploit: version: '2' services: dockerdj: image: openidentityplatform/opendj:latest containername: ldap environment: ROOTUSERDN: "cn=han" ROOTPASSWORD:...