CVE-2025-9491_POC

CVE-2025-9491 LNK 混淆概念验证 一个概念验证工具，用于演示 Windows 快捷方式 .lnk 文件漏洞 ZDI-CAN-25373/CVE-2025-9491。该工具展示了如何通过利用空白字符填充，在 .lnk 文件中隐藏恶意命令行参数。 本工具仅供教育和授权的安全测试目的使用。未经授权的计算机系统访问是违法的。仅在你拥有或已获得明确许可的系统上使用此工具。 目录 描述 漏洞详情 安装 用法 创建模式 混淆模式 解析模式 致谢 描述 这是一个概念验证工具，用于创建和操作 Windows .lnk（快捷方式）文件，以演示 CVE-2025-9491 漏洞。该工具允许用户...

gogs-CVE-2025-8110

Gogs CVE-2025-8110 PoC 此仓库包含 CVE-2025-8110 的概念验证（PoC），该漏洞是 Gogs 中的一个远程代码执行（RCE）漏洞。该漏洞利用内部 SSH 服务器实现，允许攻击者通过 sshCommand 配置注入恶意命令。 使用方法 要运行此漏洞利用，请使用 CVE-2025-8110.py 脚本，并指定目标 Gogs URL 以及您用于反弹 shell 的监听主机/端口。 root@kitploit: python3 CVE-2025-8110.py -u -lh -lp 参数 -u, --url：目标 Gogs 实例的基 URL（例如...

EUVD-2026-68307

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...

CVE-2026-82579 AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...

CVE-2026-82579 AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...

wp2shell-poc2

wp2shell-poc 针对 WordPress 核心中未经验证的 SQL 注入的概念验证，该漏洞通过 REST 批量路由混淆（CVE-2026-63030）链式利用实现远程代码执行。 该漏洞利用无需任何凭据，除可达的目标外也无需任何配置。它通过单个端点到达注入点：POST /wp-json/batch/v1。 核心发现是未经验证的 SQL 注入——check 可确认漏洞存在，read 可演示任意数据库读取。shell 命令是可选的后渗透利用（恢复管理员凭据 → 上传插件 → 执行命令），用于展示完整影响；它并非漏洞本身。 受影响版本 分支| 受影响| 修复版本 ---|---|---...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

WordPresShell

WordPresShell 针对 CVE-2026-63030 + CVE-2026-60137 （WordPress 核心）的预认证 RCE PoC。 REST /batch/v1 路由混淆 → WPQuery authornotin SQL 注入 → 未认证 管理员创建 → WebShell。单文件，仅依赖 Python 标准库。 漏洞发现者：Adam Kues（Searchlight Cyber）。受影响版本：6.9.0–6.9.4, 7.0.0–7.0.1。已修复版本：6.9.5 / 7.0.2。 使用 root@kitploit: python3 WordPresShell.p...

CVE-2026-63030

CVE-2026-63030: wp2shell Exploit de inyección SQL por desincronización de la API Batch de WordPress Herramienta de prueba de concepto para extraer usuarios y hashes de contraseñas mediante la vulnerabilidad CVE-2026-63030 wp2shell. Información de la vulnerabilidad CVE : CVE-2026-63030 wp2shell CV...

CVE-2026-82600

SeaCMS up to version 13.6 is affected by a SQL injection vulnerability in the file /zyapi.php?ac=videolist, specifically through manipulation of the ids argument. The flaw allows remote, unauthenticated attackers to execute arbitrary SQL queries with low complexity . The impact is rated HIGH (7.3...

EUVD-2026-68305

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-82600 SeaCMS zyapi.php sql injection

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

EEF-CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Summary Improper Control of Generation of Code Code Injection vulnerability in ash-project ash\ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval\string/2. The documented prompt: fn input, context - ... end...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-77956

CVE-2026-77956 is a code injection vulnerability in ash_ai (ash-project, Elixir), affecting versions 0.1.0 through before 1.0.0 . The root cause lies in AshAi.Actions.Prompt, which evaluates prompt content via EEx.eval_string/2. When a prompt uses the documented function form and incorporates req...

EUVD-2026-68303

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-46529

RCE mediante inyección de argv en PDF CVE-2026-46529 atril/xreader/evince Prueba de concepto funcional para la inyección de argv en evspawn shell/ev-application.c. Un solo clic en cualquier lugar de la página renderizada de un PDF manipulado desencadena la ejecución arbitraria de código como el...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusión de algoritmo JWT mediante inyección de kid Código del programa servidor Node.js + exploit en Python root@kitploit: // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient =...

wp2shell

wp2shell — WordPress 核心预认证远程代码执行 CVE-2026-63030 （批量路由混乱，CVSS 7.5）+ CVE-2026-60137 （SQL 注入，CVSS 9.1） WordPress 核心中的预认证远程代码执行链，无需插件、无需特殊配置，在默认安装即可生效。 受影响版本 版本范围| 影响| 修复版本 ---|---|--- WordPress 7.0.0 – 7.0.1| 完全 RCE| 7.0.2 WordPress 6.9.0 – 6.9.4| 完全 RCE| 6.9.5 WordPress 6.8.0 – 6.8.5| 仅 SQL 注入| 6.8...