CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

RingBufferDetonator

环形缓冲区引爆器 这是一个概念验证程序，用于触发并证明 rbpercpuempty 中的逻辑错误。触发该错误的程序将会在内核空间的 tracingreadpipe 中陷入忙等待死循环，并且无法通过任何 UNIX 信号（包括 SIGKILL）挂起或终止。 尽管该程序的行为（死循环和 CPU 燃烧）与 linux 4.5 中修复 的 seqbufused 计算错误类似，但本程序旨在证明另一个具有完全不同原因的错误的存在，据信该错误存在于 3.10 至 5.14-rc1 版本的内核中（另请参见 PoC 执行结果）。 免责声明：此概念验证程序可能会导致您的 Linux...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

ETQ Reliance - Authentication Bypass via Trailing Space

An authentication bypass vulnerability exists in ETQ Reliance on the CG legacy platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login pag...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — In simple terms, the vulnerability is that the code looks different from what it will be when compiled : The attack consists of using embedded control characters in comments and strings to reorder source code characters in a way that...

OpenPLC_v3

OpenPLC Runtime version 3 Introduction OpenPLC is an open-source programmable logic controller based on easy-to-use software. Our focus is to provide a low-cost industrial solution for automation and research. OpenPLC has been used in many research papers as a framework for industrial cybersecuri...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

CVE-2024-50968

CVE-2024-50968 描述 itsourcecode Agri-Trading Online Shopping System 1.0 的“添加到购物车”功能存在业务逻辑漏洞，允许远程攻击者在向购物车添加产品时操纵 quant 参数。通过将数量值设置为 -0，攻击者可以利用应用程序总价计算逻辑中的缺陷。此漏洞导致总价降至零，使攻击者能够将商品添加到购物车并继续结账。 漏洞类型 业务逻辑漏洞 产品供应商 itsourcecode 受影响产品代码库： Agri-Trading Online Shopping System - 1.0 受影响组件： 其 sourcecode...

CVE-2024-50944

CVE-2024-50944 Description SimplCommerce is affected by an integer overflow vulnerability in the cart logic, allowing manipulation of product quantities and total prices via crafted quantity parameters. Detection Method An attacker can detect this vulnerability by adding a product to the cart wit...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Inyección de variables de entorno en funciones serverless a través del evento Código del programa simulación de Python Lambda root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environmen...

CVE-2026-50198 Wallos: Cross-user subscription cost inference via replacement_subscription_id

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...

CVE-2024-25832-PoC

CVE-2024-25830 和 CVE-2024-25832 - DataCube3 不当访问控制与无限制文件上传。 概述 本仓库提供了一个针对 DataCube3 设备的两步利用链概念验证（PoC）。它结合了 CVE-2024-25830（不当访问控制）来提取 root 密码，以及 CVE-2024-25832（无限制文件上传）来部署反向 Shell 脚本。该 PoC 补充了博文“DataCube3 漏洞报告”中的详细漏洞分析。 受影响版本 所有 F-logic DataCube3 设备版本 1.0。 PoC 脚本用法 root@kitploit: Usage: python...

CVE-2017-7089

CVE-2017-7089 影响 ：处理恶意制作的网页内容可能导致通用跨站点脚本攻击 描述 ：在处理父标签时存在逻辑问题。通过改进状态管理解决了此问题。 Safari 10 本地同源策略绕过 root@kitploit: function Pewvar doc=open'parent-tab://apple.com';doc.document.body.innerHTML='';Click me! 由Frans Rosén提供的利用代码 root@kitploit: data:text/html,function...

check-cve-2026-23111

CVE-2026-23111 防御性验证脚本 概述 CVE-2026-23111 是 Linux 内核 nftables 中的一个漏洞，在启用了用户命名空间和 nftables 的系统上，非特权用户可利用该漏洞实现本地权限提升。12 公开的厂商和政府公告将其描述为一个影响 Linux 发行版的本地问题，并强调修补是首要修复措施。34 本仓库包含一个防御性验证脚本 ，旨在帮助评估主机是否暴露了与该 CVE 相关的技术条件，而无需提供权限提升漏洞利用程序。它会检查相关的内核和运行时条件，可选地加载 nftables 模块以进行完整的功能测试，尝试使用 unshare 和 nft...

CVE-2026-31431-CopyFail-Linux-PrivEsc

CVE-2026-31431 CopyFail Linux 本地权限提升 本仓库演示并解释了 CVE-2026-31431，即 Linux 内核复制失败本地权限提升漏洞。该漏洞允许以读取权限打开的文件在页缓存中被覆盖数据。 此仓库仅用于教育目的，并在受控环境中展示该漏洞。 包含的文件如下： root@kitploit: ├── exploit │ ├── copyfail.py 自定义漏洞利用程序，可针对任何具有读取权限的文件 │ ├── originalpayload.txt 原始漏洞利用程序使用的 payload 副本 │ ├── copyfailoriginal.py...

CVE-2026-47423-dompurify-xss-detector

Herramienta de detección de bypass de sanitizador para DOMPurify . En lugar de depender de comentarios del código fuente fácilmente eliminables o de variables de versión, esta herramienta realiza un fingerprinting lógico sobre los bundles JavaScript de producción minificados para identificar...

CVE-2026-78904-Digital-Dinar-Drain

CVE-2026-78904 — Drenaje de Dinar Digital API de Emisión de CBDC — Fallo de Lógica Acuñación Infinita...

wordpress-batch-rce-lab

wp2shell: RCE por lotes en WordPress Un análisis técnico de CVE-2026-63030, un fallo lógico en el endpoint de lotes de la API REST de WordPress que permite que una solicitud anónima se envíe bajo la ruta y verificación de permisos de otra solicitud, encadenándose con CVE-2026-60137 inyección SQL...

CVE-2026-46300

🛡️ CVE-2026-46300 - Fragnesia A Clean & Deadly Page-Cache Attack Variant of the "Dirty Frag" family 📌 Overview CVE-2026-46300 Fragnesia is a high-severity logic flaw in the Linux kernel's socket buffer handling skbtrycoalesce within the XFRM/ESP-in-TCP subsystem espintcp ULP. An unprivileged local...

CVE-2025-26465

CVE-2025-26465 El cliente OpenSSH contiene un error de lógica entre las versiones 6.8p1 y 9.9p1 ambas incluidas que lo hace vulnerable a un ataque MitM activo si la opción VerifyHostKeyDNS está habilitada, lo que permite a un intruso malicioso hacerse pasar por un servidor legítimo cuando un...