CVE-2021-26084_Confluence

CVE-2021-26084 - Iniezione OGNL in Webwork di Confluence Server Esiste una vulnerabilità di iniezione OGNL che permetterebbe a un utente autenticato e in alcuni casi a un utente non autenticato di eseguire codice arbitrario su un'istanza di Confluence Server o Data Center. IMPORTANTE Questo explo...

CVE-2023-2744

Exploit-Titel: WP Plugins WP ERP = 1.12.2 - SQL Injection Datum: 15-10-2023 Exploit-Autor: Arvandy Software-Link: https://wordpress.org/plugins/erp/ Anbieter-Homepage: https://wperp.com/ Version: 1.12.2 Getestet auf: Windows, Linux CVE: CVE-2023-2744 Produktbeschreibung WP ERP ist das erste...

CVE-2019-9053---CMS-Made-Simple-SQL-Injection-Exploit-Modified-

CVE-2019-9053 - Exploit di SQL Injection per CMS Made Simple Modificato Descrizione Questa è una versione modificata dell'exploit di SQL injection basato sul tempo per CMS Made Simple = 2.2.9. L'exploit è stato originariamente creato da Daniele Scanu ed è stato aggiornato per una migliore...

CVE-2015-8562

CVE-2015-8562 - Reverse shell python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE header X-Forwarded-For: root@kitploit: Data vulnerabilità: 12/17/2015 Autore exploit: anarc0der Versione: Joomla 1.5 a 3.4.5 CVE : CVE-2015-8562 Come usare: root@kitploit: Apri un terminale e mettiti in ascolto...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3 è vulnerabile a Cross Site Scripting XSS. Un attaccante può iniettare codice JavaScript malevolo nella sezione "Aggiungi Nuovo Articolo", che gli consente di eseguire codice arbitrario nel contesto del browser web della vittima. Tipo di Vulnerabilità: Cross Site...

CVE-2026-72550-poc

CVE-2026-72550 — Iniezione SQL non autenticata in Friendica L'iniezione SQL a query impilate non autenticata nell'endpoint delle foto di Friendica consente a qualsiasi visitatore di eseguire SQL arbitrario...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-81827

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81707

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81698

opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...

CVE-2025-53632

CVE-2025-53632 Questo repository contiene un exploit di CVE-2025-53632 che colpisce Chall-Manager !WARNING Il modo in cui Chall-Manager gestisce gli scenari, è ancora completamente sfruttabile senza lo zip slip: basta manomettere il binario pulumi dello scenario in modo che la successiva esecuzio...

CVE-2026-81696

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81695

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81685

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2021-28378

CVE-2021-28378 Details zu dieser CVE hier. Diese CVE betrifft das Fehlen einer String-Escape-Funktion auf der Client-Seite, wenn Inhalte vom Server abgerufen werden. Sie ermöglicht es einem Angreifer, einfach beliebigen Code einzuschleusen, indem er einen Kommentar zu einem Issue oder einem Pull...

Cerberus

Cerberus एक शक्तिशाली भेद्यता स्कैनर, उपडोमेन ब्रूटफोर्सिंग के लिए aioDNS का उपयोग करता है, asyncio के साथ अतुल्यकालिक रूप से तेज़ी से स्कैन करता है, लक्ष्य के सभी पहलुओं को कवर करते हुए बैच भेद्यता स्कैनिंग, मिडलवेयर जानकारी संग्रह, स्वचालित रूप से आईपी प्रॉक्सी एकत्र करता है, वाफ़ जानकारी का पत...

Chimera

Chimera Unlea$ed Hintergrund des Tools Während DLL-Sideloading für legitime Zwecke genutzt werden kann, etwa um benötigte Bibliotheken für ein Programm zu laden, kann es auch für böswillige Zwecke verwendet werden. Angreifer können DLL-Sideloading nutzen, um beliebigen Code auf einem Zielsystem...

sql-global-injector

Ultimate-Dork web crawler e scansione della vulnerabilità SQL injection Utilizzo e Installazione root@kitploit: - Installation apt-get install python python3 git git clone https://github.com/nu11secur1ty/sql-global-injector.git python3 -m pip install requests mechanicalsoup cd sql-global-injector...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE POC. Dies war der erste öffentlich veröffentlichte Exploit für CVE-2009-1151. Syntax root@kitploit: $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demo...

CVE-2026-54718

Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...