PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the wooftextsearch AJAX action. This makes it possible for unauthenticated attackers to include and...

Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Zabbix - SQL Injection

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...

CVE-2023-6567-poc

CVE-2023-6567-poc 시간 기반 SQLi 설명 이 플러그인은 SQL 문에서 사용하기 전에 orderby 매개변수를 제대로 삭제이스케이프하지 않아, 인증되지 않은 사용자가 악용할 수 있는 SQL 인젝션으로 이어집니다. 1. 취약한 GET 요청: https://vulnerablewordpress.com/wp-json/lp/v1/courses/archive-course?csearch=test&orderby=ID&order=DESC&limit=10&returntype=html 2. GET 요청 저장 3. sqlmap -r...

CVE-2026-5281-CVE-2026-11057-fullchain

CVE-2026-5281+CVE-2026-11057 Android fullchain Device Pixel 7 Android 16 ARM64 Chromium version root@kitploit: commit 994c846bbd7a35241ba7c08158c13d66412a6993 HEAD - 146.0.7680.111, tag: 146.0.7680.111 Author: Roger McFarlane Date: Mon Mar 9 12:48:07 2026 -0700 Description Exploitation approach...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

EUVD-2026-70302

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

copy-fail-blocker

copy-fail-blocker CVE-2026-31431"Copy Fail" 및 Dirty Frag의 RxRPC 변종에 대한 BPF-LSM 완화 조치이며, AFALG 또는 AFRXRPC 소켓 패밀리를 통해 접근 가능한 커널 측 인플레이스 암호화 경로에 대한 사용자 공간 접근에 의존하는 유사한 권한 상승 취약점에도 적용됩니다. 모든 노드의 socketcreate 후크에 단일 BPF-LSM 프로그램을 연결하는 소규모 DaemonSet입니다. 이 프로그램은 프로세스 권한, 네임스페이스 또는 seccomp 프로필과 관계없이 모든 사...

CVE-2021-42237

CVE-2021-42237 これは、Assetnoteのレポートから取得したCVE-2021-42237のエクスプロイト/PoCです。 免責事項: 私はAssetnoteとは一切関係ありません。このコンテンツは教育目的のみで提供されています。 以下のPoCで、CMD-COMMAND-HEREとHostを必ず置き換えてください: root@kitploit: POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1 Host: sitecore.local Accept-Encoding: gzip, deflate...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC CVE-2026-39816 の概念実証デモ。Apache NiFi 2.8.0 における EXECUTECODE 権限バイパスで、コード実行権限を意図的に拒否されたフローデザイナーが、 グラフバンドルの ExecuteGraphQuery プロセッサを介して NiFi JVM 内で 任意の Groovy を実行できるようになります。 NiFi 2.9.0 で修正済み ZeroPath によって発見 -- 完全な技術解説はこちらで公開されています。 脆弱性 TinkerpopClientService における...

CVE-2026-4112

SonicWall SMA 8200v: 교차 매개변수 블라인드 SQL 인젝션을 통한 권한 상승 펌웨어: 12.5.0-02283 12.5.0-02002 베이스의 플랫폼 핫픽스 SonicWall 권고 1. 요약 SonicWall SMA 8200v 관리 콘솔포트 8443의 인증 후 블라인드 SQL 인젝션 취약점으로 인해 인증된 모든 관리자낮은 권한의 읽기 전용 계정 포함가 어플라이언스 구성 파일에서 기본 관리자의 SHA-512 비밀번호 해시를 추출할 수 있습니다. SonicWall은 관리 콘솔 관리자와 운영 체제 root 계정에 동일...

CVE-2026-25232-PoC

CVE-2026-25232 — Gogs 보호 브랜치 삭제 우회 Write → Admin 권한 상승 개요 필드| 세부 정보 ---|--- CVE| CVE-2026-25232 제품| Gogs Go Git Service 영향을 받는 버전| :3001 공격자 계정: attacker:Password123! 저장소에 대한 Write 권한 대상 저장소: admin/important-repo 보호 브랜치: main 기본 브랜치 1단계 — 브랜치 보호가 활성화되어 있는지 확인 브랜치가 보호되고 있으며 일반적인 방법으로는 삭제할 수 없는지...

CVE-2025-4275 — Updated!

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

SUSE CVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...