30887 matches found
CVE-2026-69482
Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally...
EUVD-2026-73516
Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally...
CVE-2026-69482
Windows Error Reporting contains a local tampering vulnerability caused by the creation of a temporary file in a directory with insecure permissions , allowing an authorized attacker to tamper with data locally. The vulnerability is rated CVSS 7.1 (HIGH) with a vector of local attack, low complex...
CVE-2025-47962-POC
CVE-2025-47962-POC Proceso de reproducción: i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explicación: IpOverUsbSvc root@kitploit: sc.exe qc IpOverUsbS...
Windows Error Reporting Tampering Vulnerability
Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally...
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...
Windows Server Update Service - Insecure Deserialization
Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise. id: CVE-2025-59287 info:...
Adobe Experience Manager Forms - Insecure Deserialization
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...
AC Smart II - Authentication Bypass
AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization. id: CVE-2025-10204 info: name: AC Smart II -...
Gladinet CentreStack & Triofox - Hardcoded Credentials
Gladinet CentreStack and Triofox 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise. id: CVE-2025-14611...
thm-cybersec-portfolio
TryHackMe 笔记 — 网络安全作品集 个人笔记和已完成的 TryHackMe 房间总结。 作为 IT 安全角色学习参考和作品集使用。 已完成的房间 | 房间| 主题 ---|---|--- 01| Linux 权限提升| Linux 提权技术 02| Sudo 缓冲区溢出| CVE-2019-18634 03| OWASP Top 10 2025：IAAA 失败| 访问控制失效、认证失败、日志记录 04| OWASP Top 10 2025：应用程序设计缺陷| 配置错误、供应链、加密、不安全设计 05| OWASP Top 10 2025：不安全的数据处理| 加密失败、注入、反序...
CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-27475
CVE-2026-27475（CVSS-B 9.2 严重） SPIP 4.4.8 中经过身份验证的不安全反序列化漏洞 更多解释请访问我的网站 RCE Gadget Attacker plugins/rcegadget/rcegadgetoptions.php root@kitploit: DEBUG:\n"; echo "File: "; vardump$this-file; echo "Data: "; vardump$this-data; echo ""; fileputcontents$this-file, $this-data; die"PROOF"; 2. 以管理员身份登录 3...
react2shell-CVE-2025-55182-full-rce-script
Next.js React2Shell（CVE-2025-55182）漏洞利用工具 一款用于在仅限授权的本地测试环境 中演示严重 React2Shell 漏洞（CVE-2025-55182 / CVE-2025-66478）的概念验证工具。 ⚠️ 严重警告：正在被积极利用 该漏洞（CVSS 10.0）正被高级威胁行为者积极利用。 Amazon Threat Intelligence 报告称，包括 Earth Lamia 和 Jackpot Panda...
WSUS-CVE-2025-59287-RCE
WSUS-CVE-2025-59287-RCE CVE-2025-59287 是一个严重（CVSS 9.8）远程代码执行漏洞，影响所有 Microsoft Windows Server Update Services（简称 WSUS），并且已被在野利用。该漏洞利用 GetCookie 端点中的不安全反序列化，允许未经身份验证的攻击者以完全 SYSTEM 权限执行任意代码。 使用方法 这个反弹 shell POC 使用起来非常简单！它接受目标 URL、攻击者 IP 和端口参数，然后构造、加密并发送恶意负载。要拦截反弹 shell，请使用类似 netcat 的监听器，例如 nc -lvnp...
CVE-2026-9998-Insecure-Deserialization-in-Blockchain-Oracle
10. CVE-2026-9998 – 区块链预言机中的不安全反序列化 概述 区块链预言机节点使用 Python 的 pickle 对来自智能合约事件的数据进行反序列化，从而使攻击者能够执行任意命令。 严重性： 严重（完整节点失陷） 预言机模拟与漏洞利用 root@kitploit: !/usr/bin/env python3 """ vulnerableoracle.py - Oracle node that listens to events and deserializes data unsafely. """ import pickle, socketserver,...
CVE-2026-76967
SAP NetWeaver Business Client is affected by an insecure deserialization vulnerability (CVE-2026-76967). The application fails to sufficiently validate certain locally stored data processed at startup. A low-privilege local attacker can replace this data with specially crafted content, which, upo...
CVE-2026-76967 Insecure Deserialization in SAP NetWeaver Business Client
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...
CVE-2026-76967 Insecure Deserialization in SAP NetWeaver Business Client
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...