CVE-2026-77689

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

CVE-2026-77689 Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

EUVD-2026-76813

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

CVE-2021-27328

对 Yeastar TG400 GSM网关的路径遍历漏洞 - 91.3.0.3 这是CVE-2021-27328的概念验证（PoC） 示例 获取固件解密密码 root@kitploit: http://192.168.43.246/cgi/WebCGI?1404=../../../../../../../../../../bin/firmwaredetect 获取 /etc/paswd root@kitploit: http://192.168.43.246/cgi/WebCGI?1404=../../../../../../../../../../etc/passwd...

CVE-2023-33869-RCE-PoC

能源安全与可靠性中心 - UNC Charlotte CVE-2023-33869 是一个命令注入漏洞，影响 Enphase Envoy 固件版本 D7.0.88。该漏洞允许攻击者在受影响设备上以 root 权限注入并执行任意命令。Enphase Envoy 是一种太阳能微型逆变器网关设备，通常部署在住宅和商业太阳能系统中，这使得该漏洞对关键基础设施和物联网环境尤其令人担忧。...

CVE-2022-22947

CVE-2022-22947 SpringCloudGatewayRCE Code By:Junsheng @橘子网络安全实验室 橘子网络安全实验室 https://0range.team/ 0x00 风险概述 本工具仅限授权安全测试使用,禁止未授权非法攻击站点 在线阅读《中华人民共和国网络安全法》 0x01 工具使用 运行中提示 0x02 Bug问题 Bug请提交Issues，有时间会看的。...

idamcp

IDA Pro MCP Server This project provides a Model Context Protocol MCP server for integrating IDA Pro with AI agents like Gemini, Claude, and Jetski. It features a gateway-based proxy architecture, an embedded relational SQLite query engine, and headless session management to support advanced...

kanidm v1.11.2

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

cve-2025-24035-rds-websocket-dos-test

CVE-2025-24035 WebSocket压力测试（安全） 🚨 免责声明 ：这不是漏洞利用。此脚本仅用于模拟，仅应在安全实验室环境中用于教育目的。 目的 此测试发送一个故意过大的WebSocket头部，以模拟针对RD网关服务（如受CVE-2025-24035影响的服务）的畸形请求。 法律声明 ⚠️ 未经明确授权，请勿针对任何系统使用此工具。未经授权的使用可能违法。 使用方法 root@kitploit: python3 testabnormalrdswebsocket.py 根据本地实验室设置修改脚本中的IP地址。...

CVE-2023-4966

CVE-2023-4966 一个用于利用CVE-2023-4966 Citrix信息泄露漏洞（Bleed）的利用脚本 黑客已广泛利用此Citrix网关漏洞，本脚本支持并发，可对目标文件或单个目标进行利用 安装： root@kitploit: git clone https://github.com/sanjai-AK47/CVE-2023-4966.git cd CVE-2023-4966 pip install -r requirements.txt python3 exploit.py -h 单目标利用： root@kitploit: python3 exploit.py -d...

Check-Point_poc

Check-Pointpoc Vulnerabilidad de lectura arbitraria de archivos en Check-Point Security Gateway CVE-2024-24919 python Check-Pointpoc.py -h root@kitploit: -. -. OO . OO . /. -. ,-.-'/. -. ,-.-' \ .' / | |OO\ .' / | |OO \ /\ | | \ \ /\ | | \ \ \ | | |/ \ \ | | |/ .' ,| |.' .' ,| |.' / .'. | | /...

CVE-2025-5777

🩸 CVE-2025-5777 - CitrixBleed 2 Vulnerabilidad de Divulgación de Memoria en Citrix NetScaler / ADC 📌 1. Resumen Ejecutivo CitrixBleed 2 se refiere a una vulnerabilidad crítica de divulgación de memoria que afecta a: 🏢 Citrix NetScaler ADC 🌐 NetScaler Gateway 🔐 Dispositivos VPN expuestos a Interne...

CVE-2026-90449

CVE-2026-90449 affects a reverse proxy/gateway in an ICS/OT deployment (per the referenced CISA advisory icsa-26-254-01 ). When a particular authentication mode is configured, the reverse proxy forwards requests to a bundled third-party administrative interface without first applying the gateway'...

Vulnerabilities Affecting SICK CorivaEngine

SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 扫描器 针对 CVE-2025-12101 的多线程漏洞扫描器 —— Citrix NetScaler 通过 SAML RelayState 的 XSS 漏洞。 概述 CVE-2025-12101 是 Citrix NetScaler ADC 和 Gateway 产品中的一个反射型 XSS 漏洞，影响 /cgi/logout 端点，通过 RelayState 参数触发。 CVSS 评分： 5.9（中等） 功能特性 ✅ 单主机 -u 或多主机 -f 扫描 ✅ 多线程扫描（1-100 线程） ✅ 唯一载荷验证（零误报） ✅ 双协议测试（HTTP + HTTPS）...

CVE-2026-80462

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

EUVD-2026-76099

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462 Privilege Escalation in Progress Chef Automate

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462 Privilege Escalation in Progress Chef Automate

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462

Progress Chef Automate is affected by a privilege escalation vulnerability in its API gateway and identity validation path , allowing an unauthenticated network actor to gain elevated access to protected functionality under specific conditions. The vulnerability is rated CVSS 3.1 10.0 (Critical) ...