CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

blind-ssrf-chains

Einführung Was ist Server Side Request Forgery SSRF? Server Side Request Forgery tritt auf, wenn du einen Server dazu bringen kannst, in deinem Namen beliebige Anfragen auszuführen. Da die Anfragen vom Server gestellt werden, ist es möglicherweise möglich, auf interne Ressourcen zuzugreifen, je...

SecGen

LO SVILUPPO È STATO SPOSTATO SU http://github.com/cliffe/SecGen/, QUESTA REPO NON È PIÙ MANTENUTA E PROBABILMENTE NON FUNZIONERÀ! Security Scenario Generator SecGen Riepilogo SecGen crea macchine virtuali vulnerabili così gli studenti possono imparare le tecniche di penetration testing. Box come...

Digital-Privacy

English | 简体中文 There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. Bruce Schneier《Applied Cryptography》 Inhalt : Informationsschutz,...

nginxpwner

Nginxpwner Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities. Install: root@kitploit: cd /opt git clone https://github.com/stark0de/nginxpwner cd nginxpwner chmod +x install.sh ./install.sh Install using Docker root@kitploit: git clone...

nginxpwner

Nginxpwner نغينكس‌باونر هي أداة بسيطة للبحث عن الأخطاء في التهيئة والثغرات الشائعة في إن‌جينكس. التثبيت: root@kitploit: cd /opt git clone https://github.com/stark0de/nginxpwner cd nginxpwner chmod +x install.sh ./install.sh التثبيت باستخدام دوكر root@kitploit: git clone...

path-auditor

PathAuditor The PathAuditor is a tool meant to find file access related vulnerabilities by auditing libc functions. The idea is roughly as follows: Audit every call to filesystem related libc functions performed by the binary. Check if the path used in the syscall is user-writable. In this case a...

Sherlock

Veraltet. Schauen Sie sich stattdessen Watson an. Sherlock PowerShell-Skript zum schnellen Auffinden fehlender Software-Patches für lokale Privilegieneskalations-Schwachstellen. Derzeit wird nach Folgendem gesucht: MS10-015 : Benutzermodus zu Ring KiTrap0D MS10-092 : Aufgabenplaner MS13-053 :...

a2sv

1. A2SV? Automatisches Scannen auf SSL-Sicherheitslücken. HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc. A. Unterstützte Sicherheitslücken root@kitploit: - CVE-2007-1858 Anonymous Cipher - CVE-2012-4929 CRIMESPDY - CVE-2014-0160 CCS Injection - CVE-2014-0224 HeartBleed - CVE-2014-3566...

GHSA-HR6J-W4MW-G9MJ alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Summary A single unauthenticated HTTP request to a path starting with ? e.g. GET ? HTTP/1.1 crashes the entire server process. The request line parser passes the path to sanitizeRequestPath which indexes the first byte of the path after stripping the query string. It does so without checking that...

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Summary A single unauthenticated HTTP request to a path starting with ? e.g. GET ? HTTP/1.1 crashes the entire server process. The request line parser passes the path to sanitizeRequestPath which indexes the first byte of the path after stripping the query string. It does so without checking that...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ Dieses Tool dient ausschließlich zu Bildungs- oder Bug-Bounty-Zwecken. Die unbefugte Nutzung außerhalb kontrollierter Umgebungen ist strengstens untersagt. Beschreibung Ein Tool zur Ausnutzung von CVE-2026-41940, einer kritischen Authentifizierungsumgehung in cPanel & WHM CVSS...

GHSA-W23P-WRP7-CH38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - Offenlegung von Benutzerinformationen Dieses Repository enthält einen Proof-of-Concept-Exploit PoC für CVE-2026-53959 Haftungsausschluss Dieses Projekt dient ausschließlich Bildungszwecken und autorisierten Sicherheitstests. Verwenden Sie es nicht gegen Systeme,...

Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...

GHSA-79CW-HFCC-7MW9 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...

GHSA-H854-C3M3-MH5V Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

ShuckNT

🔐 ShuckNT : Shuck den Hash, bevor du versuchst, ihn zu knacken | Das Skript von Shuck.sh ShuckNT ist das Skript des Online-Dienstes Shuck.sh für den Einsatz vor Ort jetzt online ausprobieren!. Es wurde entwickelt, um Authentifizierungstoken auf Basis des Data Encryption Standard DES herabzustufen...