CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

EUVD-2026-69918

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

EUVD-2026-69909

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-84797

Craft CMS versions 5.0.0-RC1 through before 5.10.11 are affected by an authorization bypass in ElementsController::actionDuplicate(). The vulnerability stems from missing authorization checks on the deleteProvisionalDraft parameter, allowing any authenticated user holding the createEntries permis...

CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-44680-MikroORM-SQL-Injection-Exploit-Framework

CVE-2026-44680 - MikroORM SQL注入利用框架 面向安全研究人员的专业概念验证工具 🔍 概述 CVE-2026-44680 是一个影响 MikroORM（一个流行的 Node.js TypeScript ORM）的关键 SQL 注入漏洞。该利用框架为安全研究人员和渗透测试人员提供了一个专业工具，用于检测和利用该漏洞。 作者： Sudeepa Wanigarathna 版本： 1.0.0 分类： 专业安全研究工具 🚨 漏洞详情...

CVE-2026-53913

CVE-2026-53913 — camel-keycloak 故障开放（Fail-Open）身份验证绕过 针对同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（集成了 Camel 4.20.0 ）...

sxwp2shell

/ / / / / / | |/ / / / / / / / / / | // / / / / / / / / / / / / // | / /// / // // / // / /|| sxwp2shell — Exploit RCE pre-autenticación para WordPress mediante confusión de ruta batch en la API REST CVE-2026-63030 + inyección SQL CVE-2026-60137. Afecta: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Instalación...

CVE-2026-42945

RIFT — 远程注入与故障触发 作者： Michael Sanji Winaya Prawiradibrata AI 合著者： Varanus — sahabatku 针对 NGINX 的 ngxhttprewritemodule 的堆缓冲区溢出利用框架。 一个集侦察与利用于一体的工具。零外部依赖。 仓库内容 文件| 描述 ---|--- rift.py| 主工具。 侦察与利用合并在一个脚本中（1026 行）。 README.md| 本文档。 运行要求 Python 3.6+（仅标准库 — 无需 pip、无需 venv、无依赖项 ） 快速上手 root@kitploit: 1. 全面侦...

CVE-2024-54085

CVE-2024-54085: Critical Authentication Bypass Vulnerability in AMI MegaRAC BMC Affected Systems The vulnerability affects a wide range of server hardware from major manufacturers: AMI MegaRAC SPx : versions 12.x up to 12.7 and 13.x up to 13.5 HPE Cray XD670 : versions 1.09, 1.13, 1.17 Asus...

CVE-2023-51385-exploit

CVE-2023-51385-exploit...

CVE-2018-5955

CVE-2018-5955 Un exploit para CVE-2018-5955 GitStack 2.3.10 Ejecución Remota de Código No Autenticada Exploit: GitStack 2.3.10 Ejecución Remota de Código No Autenticada Fecha: 18.01.2018 Enlace del software: https://gitstack.com/ Autor del exploit: Kacper Szurek Exploit original:...

CVE-2007-2447-RCE

Este exploit te ayuda a obtener una reverse shell, explotando Samba 3.0.20 3.0.25 · Al ejecutar el script con python3 con el parámetro --help, nos pide una serie de parámetros root@kitploit: --lhost LHOST tu host ip donde se recibirá la shell --lport LPORT tu puerto puerto donde se recibirá la...

CVE-2021-3156

CVE-2021-3156 Visualización, Fuzzing, Explotación y Parche de la Vulnerabilidad Baron Samedit Ver informe » Francesco Marchiori · Alessandro Lotto Tabla de Contenidos 1. Resumen 2. Visualización 3. Fuzzing 4. Explotación 5. Parche 🧩 Resumen Cualquier sistema operativo basado en Unix dispone del...

CVE-2021-31762

..| CVE-2021-31762 |.. Descripción : Explotando un ataque de falsificación de solicitudes entre sitios CSRF para crear un usuario privilegiado a través de la función de añadir usuarios de Webmin y luego obtener una reverse shell a través de la función de procesos en ejecución de Webmin Versión...