htshells

HTSHELLS - 通过 .htaccess 文件实现的自包含 Web Shell 及其他攻击。 攻击的命名方式为 module.attack.htaccess，并按攻击类型分组存放在目录中。选择你需要的攻击，将其复制到一个新文件并命名为 .htaccess，检查文件以确认在上传前是否需要编辑。除非文件另有说明，Web Shell 通过查询参数 c 执行命令。 要准备攻击，运行 ./prepare.sh file 生成待上传的 .htaccess 文件。示例： root@kitploit: $ ./prepare.sh shell/modphp.shell.htaccess ┬...

CVE-2024-24919

CVE-2024-24919 Descrizione CVE-2024-24919 è una vulnerabilità critica di divulgazione di informazioni che interessa diversi prodotti di sicurezza Check Point, tra cui Quantum Security Gateways e CloudGuard. Ha un punteggio CVSS elevato di 8.6 e consente a utenti non autenticati di leggere file...

The vulnerability affects the embedded energy-independent single-write eFUSE memory module in Realtek RTL8762C, a highly integrated wireless system on chip (SoC). This module allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the embedded energy-independent single-write eFUSE memory in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to the fact that power is turned on before the access control mechanism is activated. Exploiting this vulnerability can allow a hacker to...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

CVE-2024-10355

Código-fonte Download gratuito do software de gerenciamento de bombas de gasolina | SourceCodester Descrição Vulnerabilidade de SQL Injection no software de gerenciamento de bombas de gasolina sourcecodester v1.0. Foi encontrada uma vulnerabilidade classificada como de alto risco, afetando alguma...

CVE-2026-42392

CVE-2026-42392 affects Open-Xchange Dovecot . An attacker with valid credentials can send an invalid IMAP URLFETCH command, causing uninitialized memory to be included in the error response returned to the client. This discloses process memory contents , which may contain sensitive data. The CVSS...

PixelDump_CVE-2016-8462

PixelDump - CVE-2016-8462 PixelDump CVE-2016-8462 war eine der Pixel-Bootloader-Schwachstellen, die von beaups und Jon 'jcase' Sawyer gefunden/ausgearbeitet wurden. Haftungsausschluss Dies ist ein schmutziger POC, der nie zur Veröffentlichung gedacht war. Ich habe nur ein anderes Projekt kopiert,...

optionsbleed

optionsbleed Questo è un codice proof of concept per testare il bug Optionsbleed in Apache httpd CVE-2017-9798. Ti consigliamo di utilizzare lo strumento Snallygaster; include un controllo per optionsbleed: root@kitploit: snallygaster -t optionsbleed host uso root@kitploit: optionsbleed -h -n N -...

Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...

CVE-2018-1313

Questo repository non contiene un README...

CVE-2026-51660

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-0257

Forgia un cookie di override dell'autenticazione di GlobalProtect usando la chiave pubblica dalla TLS CVE-2026-0257 Uno script proof-of-concept per testare un portale o gateway GlobalProtect PAN-OS target per la CVE-2026-0257. Lo script tenterà di forgiare un cookie di override dell'autenticazion...

CVE-2025-5777

CVE-2025-5777 Exploit per la Perdita di Memoria di Citrix NetScaler !WARNING Questo script è destinato esclusivamente a scopi educativi e di ricerca. Non utilizzarlo contro sistemi senza autorizzazione esplicita. L'accesso o il test non autorizzato è illegale e non etico. Leggi il DISCLAIMER...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

CVE-2026-74739

A flaw was found in the Linux kernel's clsu32 module, responsible for traffic control. This vulnerability occurs because the u32bindclass function incorrectly handles certain data structures, leading to a slab-out-of-bounds read. A local attacker with network administration capabilities could...

EUVD-2026-67100

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

CVE-2026-26897

EcoOnline EHS for Android (com.airsweb.v10 v0.2.499) is vulnerable to a deep link validation bypass in its MainActivity. The app's ehs-app:// scheme handler performs a naive string replacement (ehs-app: → https:) and loads the result into the WebView without applying the host allow-list used on a...

CVE-2024-50848

CVE-2024-50848: XXE no WorldServer v11.8.2 Uma vulnerabilidade de XML External Entity XXE nas funcionalidades de importação de objetos e importação de memória de tradução do WorldServer v11.8.2 pode levar ao acesso a informações sensíveis do sistema e à execução de comandos arbitrários através do...