300073 matches found
CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...
EUVD-2026-80668
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...
CVE-2026-92461 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...
CVE-2026-92461
yshop-crm through 2.1.3 is affected by a missing authorization flaw in the GET /admin-api/crm/flow/flow-users endpoint. Any authenticated back-office user can retrieve approval workflow data, including approval chain topology , step ordering , and approver identifiers , as well as personal inform...
CVE-2026-92461 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...
EUVD-2026-80666
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...
EUVD-2026-80665
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
CVE-2026-92460
CVE-2026-92460 affects yshop-crm through 2.1.3 , a CRM application. The vulnerability is a missing authorization check on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide operation log without proper permission checks. Ex...
CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...
EUVD-2026-80663
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...
CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...
CVE-2026-92458
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler. The endpoint GET /admin-api/product/store-product/sale lacks proper permission checks, allowing authenticated back-office users to iterate sequential product IDs to withdraw entire...
CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...
CVE-2026-42945
RIFT — 远程注入与故障触发 作者： Michael Sanji Winaya Prawiradibrata AI 合著者： Varanus — sahabatku 针对 NGINX 的 ngxhttprewritemodule 的堆缓冲区溢出利用框架。 一个集侦察与利用于一体的工具。零外部依赖。 仓库内容 文件| 描述 ---|--- rift.py| 主工具。 侦察与利用合并在一个脚本中（1026 行）。 README.md| 本文档。 运行要求 Python 3.6+（仅标准库 — 无需 pip、无需 venv、无依赖项 ） 快速上手 root@kitploit: 1. 全面侦...
Exploit for CVE-2026-84616
AppleAVE2 CVE Research — iOS 27.0 !IMPORTANT This repos...
CVE-2026-46331
CVE-2026-46331 pedit COW – Linux net/sched 包编辑器页缓存投毒漏洞 执行摘要 CVE-2026-46331（昵称 “pedit COW” ）是 Linux 流量控制子系统中一个本地内核权限提升漏洞。无特权用户（在无特权网络命名空间中）可以配置 actpedit （包编辑器）过滤器，触发对页缓存的 部分写时复制（COW）写入 。实际上，内核将攻击者控制的数据写入文件的内存映像而无需将页面标记为私有 ，从而损坏该文件的缓存副本。至关重要的是，该漏洞仅需 CAPNETADMIN（可在用户命名空间中获取），且不会修改磁盘上的文件。实践中，一个名为...
CVE-2017-1000117
CVE-2017-1000117 - PoCs root@kitploit: git clone --recurse-submodules "https://github.com/Manouchehri/CVE-2017-1000117.git" cat /tmp/pwned.txt Go root@kitploit: go get "github.com/Manouchehri/CVE-2017-1000117" cat /tmp/pwned.txt...
OpenSTAManager_RCE_Exploit-CVE-2026-38751-
OpenSTAManager RCE 利用工具 CVE-2026-38751 概述 此 Python 脚本利用 OpenSTAManager 2.10 版本中的一个远程代码执行漏洞，编号为 CVE-2026-38751。该利用工具允许经过身份验证的用户上传恶意模块并在目标系统上执行任意命令。 漏洞详情 CVE ID ：CVE-2026-38751 产品 ：OpenSTAManager 版本 ：2.10 类型 ：远程代码执行 RCE 攻击向量 ：基于 Web，需要有效身份验证 利用原理 该利用工具遵循以下步骤： 1. 身份验证 ：使用提供的凭据登录 OpenSTAManager 应用 2...
Log4jTools
Log4jTools 用于调查 Log4j CVE-2021-44228 的工具 漏洞说明与演示 https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py （从 JNDI 查找提供的 LDAP 路径获取 Java payload） 依赖：curl（系统自带），requests（Python） 示例命令： root@kitploit: python FetchPayload.py ldap://maliciouserver:1337/path + getting object from...