FortiWeb-CVE-2025-52970-Authentication-Bypass

🚨 FortiWeb 認証バイパス → リモートコード実行 📌 概要 このリポジトリは、FortiWeb の認証バイパス を実証し、それを連鎖させて リモートコード実行 RCE を達成するものです。 このエクスプロイトは、脆弱なエンドポイントを悪用して SQL ペイロードを注入し、ウェブシェルをアップロードし、HTTP ヘッダーを介してコマンドを実行します。 ⚠️ 免責事項 : このプロジェクトは教育および研究目的のみ です。 所有していない、またはテストする明示的な許可を得ていないシステムに対して使用しないで ください。 Netlas、FOFA、Shodan FortiWeb AND...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.0 RCE 脆弱性 これは CVE-2017-5638 を悪用するスクリプトです。攻撃者は Content-Type ヘッダーを介して Web アプリケーションに OS コマンドを注入できます。 Apache Struts 2 は、Java EE Web アプリケーションを開発するためのオープンソースの Web アプリケーションフレームワークです。Java Servlet API を利用および拡張し、開発者がモデル・ビュー・コントローラ（MVC）アーキテクチャを採用することを推奨しています。 2017 年 3...

CVE-2023-20198

CVE-2023-20198 CVE-2023-20198 검사 스크립트는 다음을 기반으로 합니다: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ 알려진 임플란트를 확인하기 위해 Authorization 헤더가 있는 업데이트된 버전을 포함합니다. !! 업그레이드된 임플란트를 찾도록 업그레이드됨 이 스크립트는 200 코드가 반환된 응답의 길이를 확인하고, 길이가 32자보다 짧은지 검사합니다. 32자보다 짧은 길이를 반환하는 각 IP는 장...

CVE-2026-105396

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2025-8088-Winrar-Tool

CVE-2025-8088 WinRAR エクスプロイト 高度な WinRAR パストラバーサルエクスプロイトツール ADS と RAR5 ヘッダー操作を利用して、WinRAR のパストラバーサル脆弱性（CVE-2025-8088）を悪用する悪質な RAR アーカイブを作成するための洗練された GUI ツールです。 特徴 ADS 悪用 - ペイロードを隠すための NTFS 代替データストリーム RAR5 ヘッダー操作 - パスインジェクションのための直接ヘッダーパッチ GUI インターフェース - クリーンでモダンなユーザーインターフェース スタートアップターゲット -...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ このツールは教育またはバグバウンティの目的のみで作成されています。管理された環境外での不正使用は固く禁止されています。 説明 CVE-2026-41940を悪用するためのツールです。これはcPanel & WHMにおける重大な認証バイパス（CVSS 10.0）であり、認証されていない攻撃者がAuthorizationヘッダーを介してサーバー側のセッションファイルにCRLFシーケンスを注入することで、rootレベルのWHMアクセスを取得できるものです — 認証情報は不要です。 仕組み...

CVE-2018-0114-PoC

CVE-2018-0114 PoC PentesterLab 용으로 작성함 PentesterLab 사용자라면 속임수를 쓰지 마세요. 직접 배우는 것이 훨씬 낫습니다. 누군가에게 유용하길 바랍니다. 아니면 미래의 저에게라도요 : 예시 $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid': '[email protected]', 'use': 'sig', 'n':...

ps5-uart

サリナ近くの24ピンヘッダー EDM-010 emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. emc起動時にlowにするとemc romが460800でuartシェルに入る 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, emcがリセットされるとlowになる 9 0v? 10 gnd 11 titania uart0 tx efc fw: 460800, eap fw: 691200 12 titania uart0 rx efc fw: 460800, eap fw: 691200 13...

CallStranger

CallStranger 이 스크립트는 CallStranger CVE-2020-12695 취약점을 확인하기 위해 Yunus Çadırcı https://twitter.com/yunuscadirci가 제작했습니다. 공격자는 이 취약점을 다음과 같은 목적으로 사용할 수 있습니다. 데이터 유출을 위한 DLP 우회 증폭 반사 TCP DDoS / SYN Flood의 소스로 수백만 개의 인터넷 노출 UPnP 장치 사용 인터넷 노출 UPnP 장치를 통한 내부 포트 스캔 이 스크립트는 데이터 유출만 시뮬레이션합니다. 자세한 정보는...

apple-positional-audio-codec-invalid-header

CoreAudio 패치CVE-2025-31200에 대한 개념 증명, iOS 18.4.1에서. 설명 글은 https://blog.noahhw.dev/posts/cve-2025-31200/ 에 있습니다. 업데이트 2025/05/27 이를 제한된 범위이지만 임의 쓰기로까지 발전시킬 수 있었습니다. 설명 글은 곧 올라옵니다. 직접 확인하려면 패치 이전 버전의 macOS 15.4.1에서 빌드해야 합니다. check-mismatch lldb 훅을 사용하여간단한 harness로 오디오를 재생하는 방식 오디오를 재생하면 쓰기를 확인할 수...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: AppArmor: A memory leak was fixed in the verifyheader function. The function sets ns = NULL on every call, causing a memory leak in the namespace allocated during previous iterations when multiple profiles are unpacked. This also...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - mctp i2c: Handle the NULL header address. - daddr can be NULL if there is no neighbour table entry present; in that case, the TX packet should be discarded. - saddr is usually set by the MCTP core, but check for NULL in case...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: nsh: Added restoration of skb-protocol, data, macheader for the outer header in nshgsosegment. The syzbot exploited various vulnerabilities by using a crafted GSO packet for VIRTIONETHDRGSOUDP that included the following...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb-transportheader is set in bpfskbcheckmtu. The bpfskbcheckmtu helper needs to use skb-transportheader when the BPFMTUCHKSEGS flag is used: bpfskbcheckmtuskb, ifindex, &mtulen, 0, BPFMTUCHKSEGS. The transportheader i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the tunnels section, there’s no need to assume that the macheader is set when using skbtunnelcheckpmtu. The recently added debug in commit f9aefd6b2aa3 “net: warn if mac header was not set” identified a bug in...

Astra Linux – Vulnerability in Waitress

Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: EFI: Do not map the entire mokvar table to determine its size. Currently, when validating the mokvar table, we re-map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, there is a issue where packets with the type UFO are dropped in the udprcvSegment function. When sending a packet with the virtionethdr structure to a tun device, if the gsotype field in the virtionethdr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Rejected malicious packets in ipv6gsoSegment. syzbot was able to create a packet with very long IPv6 extension headers, leading to an overflow of skb-transportheader. This 16-bit field has a limited range. Add the...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer. If...