CVE-2025-51726

आपके अनुरोध के अनुसार, मैंने अब दोनों कमजोरियों BA2022 और BA2015 को व्यावहारिक शोषण परिदृश्यों और PoC साक्ष्य के साथ प्रदर्शित किया है, जो दर्शाता है कि एक हमलावर वास्तविक दुनिया के संदर्भ में इन मुद्दों का दुरुपयोग कैसे कर सकता है। 📌 1. BA2022 कोड साइनिंग में कमजोर हैश – SHA-1 शोषण प्रदर्शन...

CVE-2025-67315

CSRF لتعطيل أي موظف الملخص وظيفة إدارة الموظفين معرّضة لهجوم التزوير عبر الطلبات المشتركة بين المواقع CSRF. يمكن للمهاجم خداع مسؤول مسجّل الدخول لإرسال طلب مزوّر يؤدي إلى تعطيل موظف مثل inid=1 دون علم المسؤول أو موافقته. درجة CVSS الأساسية: 5.4 متوسطة سلسلة المتجه:...

CVE-2023-34362

CVE-2023-34362 POC per CVE-2023-34362 che riguarda MOVEit Transfer Analisi Tecnica Un'analisi tecnica della causa principale della vulnerabilità può essere trovata sul nostro blog: https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/ Riepilogo Questo POC...

cve-2022-23131

cve-2022-23131 FOFA app="ZABBIX-监控系统" && body="saml" Esecuzione python cve-2022-23131.py https://www.example.com Admin Usa l'exploit per generare una signedsession, sostituisci il cookie, poi clicca su Sign in with Single Sign-On SAML Il default è Admin Rispetta i limiti: le conseguenze sono a tu...

DHCPig

DHCPig Validierung der DHCP-Härtung für Whitehats: einen Pool erschöpfen, Leases von Nachbarn kapern, Hosts mit gefälschtem ARP von ihren Adressen vertreiben und berichten, ob das Netzwerk dich gestoppt hat. Benötigt Root-Rechte und Python 3.11+. Web-UI ausführen Debian / Kali: das neueste .deb v...

Memcrashed-DDoS-Exploit

MEMCRASHED DDOS-EXPLOIT-TOOL Autor: @037 Dieses Tool ermöglicht es Ihnen, gefälschte UDP-Pakete an Memcached-Server zu senden, die von Shodan.io bezogen wurden. Voraussetzungen Das Einzige, das Sie installiert haben müssen, ist Python 3.x root@kitploit: apt-get install python3 Sie benötigen...

CVE_2021_27850_POC

Utilizzo dei comandi root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Supponendo che l...

WordPress Mang Board WP plugin <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie vulnerability

Authenticated Subscriber+ Privilege Escalation to Forged Authentication Cookie vulnerability discovered by daroo in WordPress Plugin Mang Board WP versions = 2.3.7...

BigFinger

CVE-2023-46747 - Big-IP RCE Nicht authentifiziert Dies ist ein Python3-Skript, das die nicht authentifizierte Remote-Codeausführungs-Schwachstelle CVE-2023-46747 in F5 BIG-IP -Appliances über die TMUI-Schnittstelle ausnutzt. Grundsätzlich erhältst du, wenn diese Schwachstelle ausgenutzt wird, ein...

Transformers-Forged-To-Fight-Offline-Version

Transformers: Forged to Fight, passaggio di consegne per il revival offline Questo pacchetto contiene un boot offline funzionante di Transformers: Forged to Fight, insieme a tutti gli strumenti, le patch e le note di reverse engineering utilizzati per arrivarci. È pensato per essere raccolto da...

CVE-2021-23017-POC

CVE-2021-23017-POC È stato identificato un problema di sicurezza nel resolver di nginx che potrebbe consentire a un attaccante in grado di forgiare pacchetti UDP provenienti dal server DNS di causare una sovrascrittura di memoria di 1 byte, con conseguente crash del processo worker o altri...

CVE-2025-10035

Scanner CVE-2025-10035 Visão Geral Este projeto fornece uma ferramenta para procurar sistemas potencialmente afetados pela CVE-2025-10035 , uma vulnerabilidade de desserialização no Servlet de Licença do Fortra GoAnywhere MFT. A vulnerabilidade pode permitir que um atacante com uma assinatura de...

BIT-KEYCLOAK-2026-7571 Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect OIDC clients. By manipulating client data during a session restart, an attacker can obtain an access token th...

BIT-KEYCLOAK-2026-4282 Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens,...

BIT-KEYCLOAK-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

BIT-KEYCLOAK-2026-11800 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to...

MOVEit-Exploit

MOVEit Exploit un exploit di POC per CVE-2023-34362 che colpisce MOVEit Transfer Nota: questo progetto è completato... La nostra pagina Instagram . Il nostro canale YouTube . La nostra pagina Twitter CVE-2023-34362 POC per CVE-2023-34362 che colpisce MOVEit Transfer Disclaimer Questo software è...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

PrestaShop TshirteCommerce - Directory Traversal

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. id: CVE-2023-27639 info: name: PrestaShop TshirteCommerce...

CVE-2023-44811

CVE-2023-44811 mooSocial v3.1.8 è vulnerabile a Cross Site Request Forgery CSRF che consente a un attaccante di cambiare la password dell'amministratore quando un utente amministratore autenticato fa clic sulla pagina HTML dannosa appositamente creata. Fornisco 2 pagine HTML che, quando viene fat...