433759 matches found
CVE-2022-23131
CVE-2022-23131 CVE-2022-23131 - SAML SSO bypass root@kitploit: fofa: app="ZABBIX-监控系统" && body="saml"...
CVE-2024-0012
CVE-2024-0012 CVE-2024-0012 an authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit...
CVE-2025-2294
🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...
APT-Backpack
APT-Backpack Most common used CVE's by APT, legitimate RAT and other tools used by adversary CVE's CVE-2019-11510 Pulse Connect Secure 8.2 8.3 9.0 Unauth file read CVE-2019-19781 Citrix ADC & Gateway Directory Traversal CVE-2020-5902 F5 Big IP RCE CVE-2021-1497 Cisco HyperFlex HX Unauth Command...
CVE-2026-65927
A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls. Mitigation Mitigation for this issue is either not...
sentrygrid
SentryGrid ML-driven threat detection and continuous monitoring platform built for federal zero-trust architectures. OSCAL-native, FedRAMP Moderate-aligned, hash-chained audit, three-model anomaly ensemble. Quick start root@kitploit: make setup install bun + python deps make dev-up bring up the...
CVE-2026-58455-PoC
CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass + command injection Proof-of-concept for CVE-2026-58455 : unauthenticated remote code execution in Dockwatch by Notifiarr, a self-hosted Docker container management web UI. Affects all versions through 0.6.567. Root cause verified from...
CVE-2026-2796-escape-wasm-by-using-wasm
CVE-2026-2796 — SpiderMonkey WebAssembly Sandbox Escape Proof-of-concept exploit chain for CVE-2026-2796 , a JIT miscompilation / type-confusion in Mozilla SpiderMonkey's WebAssembly import optimization "JavaScript: WebAssembly" component. A crafted wasm module obtains arbitrary read/write of the...
lean-cve-poc
CVE-2026-72844: Lean 4 Kernel Soundness Bug Proving0 = 1 axiom-free via nested inductive projection validation bypass...
CVE-2026-34910-unifi-poc
UniFi OS CVE Proof of Concept Proof of concept for authorized testing of two vectors identified as: CVE-2026-34910: auth bypass that can lead to command injection and remote code execution via the package update handler. CVE-2026-34909: path traversal that can lead to arbitrary file read via the...
CVE-2026-76565
Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL SUMMARY PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting XSS via the pricefrom and priceto GET...
Malicious code in selfsigned-certificate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...
MAL-2026-15623 Malicious code in selfsigned-certificate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...
CVE-2026-65182
A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...
CVE-2021-3560-Polkit-Privilege-Esclation
CVE-2021-3560-Polkit-Privilege-Esclation PoC Original research by Kevin Backhouse This is just a Bash PoC script, that automates the exploitation steps mentioned in Kevin Backhouse's blog. Read his post on this vulnerability:...
CVE-2026-65637
A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of...
Reset-inetpub
Reset inetpub This script restores the %SYSTEMDRIVE%\inetpub folder and its default security permissions, which are necessary as a mitigation for CVE-2025-21204 following the KB5055523 Windows update. It's intended for users who may have deleted this folder before understanding its security purpo...
WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability
Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...
MAL-2026-15621 Malicious code in gas-monitor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e [email protected] impersonates eth-gas-reporter author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas...
Malicious code in gas-monitor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e [email protected] impersonates eth-gas-reporter author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas...