Exploits

Exploits CVEs originais, PoCs de exploits e advisories de segurança por @kmkz · boffsec-services.com · @kmkzsecurity 2026 Arquivo| Alvo| Tipo| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Advisory cadeia de 3 CVEs| 9.3 CVE-2026-22191-POC.py|...

CVE-2026-55673

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

CVE-2026-55634

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-55565

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-54766

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

CVE-2026-PoCs

CVE-2026-PoCs Una raccolta curata dalla community e verificata di exploit Proof-of-Concept per le CVE divulgate nel 2026. Perché questo repo La maggior parte delle raccolte di PoC per CVE sono sparse tra thread di Twitter, gist e link di blog morti. Questo repo mira a essere l'indice unico, ben...

write-ups

write-ups RCE in Github Desktop v2.9.4 RCE tramite gh run download GitHub CLI Claude Code: esecuzione di codice non sandboxed da prompt injection tramite confusione del worktree .git — CVE-2026-55607...

SAMLRaider

SAML Raider - Estensione Burp per SAML2 Descrizione SAML Raider è un'estensione di Burp Suite per testare infrastrutture SAML. Contiene due funzionalità principali: manipolare messaggi SAML e gestire certificati X.509. Questo software è stato originariamente creato da Roland Bischofberger e Emanu...

CMS-made-simple-sqli-python3

CMS-made-simple-sqli-python3 CMS Made Simple 2.2.10 - SQL Injection riscritto per python3, CVE-2019-9053 Ho trovato problematico eseguire questo exploit su Kali Linux, poiché python2 non ha termcolor, quindi con poche modifiche l'ho fatto funzionare con python3. Tutto il merito va a:...

CVE-2023-31714

CVE-2023-31714 - Chitor-CMS 1.1.2 Injeção SQL Pré-Autenticação Descoberto por msd0pe https://github.com/waqaskanju/Chitor-CMS Projeto por waqaskanju chitor1.1.py Corrigido desde o commit 69d3442 2023/04/13 Injeção SQL foi encontrada no endpoint /editschool.php?id= e não requer nenhuma autenticaçã...

Django-faille-CVE-2025-57833_test

Test der SQL-Injection-Schwachstelle über Alias in Django Definition: Was ist ein Alias? Ein Alias ist ein Name, der einer Spalte oder einem Aggregationsergebnis in einer SQL-Abfrage gegeben wird. In Django werden Aliase mit den Methoden annotate oder alias verwendet, um berechnete Felder zu...

CVE-2022-RCE

CVE-2022-XXXX Iniezione inversa di dati spazzatura Abbonamento CVE Strumento exploit Tutorial Exploit POC RCE LOG4j Deserializzazione JNDI Payload CVE-2022-20550 CVE-2022-20551 CVE-2022-20552 CVE-2022-20553 CVE-2022-20554 CVE-2022-20555 CVE-2022-20556 CVE-2022-20557 CVE-2022-20558 CVE-2022-20559...

CVE-2025-65950

CVE-2025-65950: WBCE CMS ist anfällig für zeitbasierte Blind-SQL-Injection über den groups-Parameter Übersicht c. Erfassen Sie die POST-Anfrage, die an /wbce/admin/users/save.php gesendet wird, wenn die Schaltfläche „Speichern“ angeklickt wird...

bordair-multimodal

Dataset di Iniezione di Prompt Multimodale 516.588 campioni etichettati 251.782 attacco + 251.576 benigni, più una suddivisione di validazione reale di 13.230 campioni in cinque versioni del dataset più l'ingestione di dataset esterni, coprendo attacchi cross-modali, multi-turn, suffisso...

laravel-threat-detection

Laravel Threat Detection Rilevamento passivo delle intrusioni per Laravel — osserva ogni injection SQL, XSS, scanner e sonda bot che colpisce la tua app, registrata con pieno contesto. È un IDS, non un WAF: non blocca, filtra o modifica mai una richiesta. Aggiungilo a qualsiasi app Laravel 10–13 ...

CVE-2025-64459-hunter

CVE-2025-64459-hunter Schneller Netzwerkscanner für CVE-2025-64459 Django SQL-Injection-Schwachstelle. Installation root@kitploit: pip install -r requirements.txt Verwendung root@kitploit: Scan single IP python cve202564459hunter.py -t 192.168.1.100 Scan CIDR range python cve202564459hunter.py -t...