CVE-2024-22120-RCE-with-gopher

使用方法 root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 示例场景 你发现了一个运行在 IP 192.168.1.100 上的 Zabbix 服务器，并且拥有一个低权限用户，其详细信息如下： 会话ID（sid）：d82bf6715e1d3c1f25 主机ID（hostid）：10107 PHP 会话ID（phpsessid）：a4g7f48d9j3r7h8s9g 你希望利用此脚本利用 RCE 漏洞。 运行脚本 root@kitploit: python...

CVE-2024-3183-POC

CVE-2024-3183-POC 针对 CVE-2024-3183 的 POC（FreeIPA Rosting） 影响： 低权限用户可以获得所有域用户密码的哈希，并执行离线暴力破解（kerberoasting）。 修补 impacket-getTGT： 1. 将 decoder.decode.defaultErrorState = stGetValueDecoderByTag 添加到 impacket/krb5/kerberosv5.py。 2. 尽情享受吧！ POC1： 1. 将 decoder.decode.defaultErrorState =...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

EUVD-2026-71445

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

EUVD-2026-66332

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...

CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-5173

🦊 CVE-2026-5173：GitLab WebSocket 未授权方法执行 PoC 🛠️ 概述 CVE-2026-5173 允许低权限的已认证攻击者通过 GitLab 的 WebSocket（/-/cable）端点调用受限的后端方法，尤其是通过 GraphqlChannel。 这可能导致敏感数据泄露 （高机密性）以及有限的未授权操作。 受影响版本 GitLab CE/EE：16.9.6 至 18.8.8 18.9 早于 18.9.5 18.10 早于 18.10.3 已修复版本 ：18.8.9 • 18.9.5 • 18.10.3 ⚡ 功能特性 简洁现代的 Python 3 PoC...

CVE-2026-78590

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

EUVD-2026-70061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...

CVE-2026-73751

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

CVE-2026-73753

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73753 Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

PT-2026-84471

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated low-privileged user can execute arbitrary commands as a privileged user on the underlying operating system through affected command-line...

CVE-2026-34213

CVE-2026-34213 一个低权限的 Docmost 用户可以向通用上传端点提供一个受害者的 attachmentId，并覆盖同一工作空间内另一页面的存储附件。 引言 我在 Docmost （开源协作文档平台）中发现、负责任地披露并复现了一个 高严重性 的授权缺陷。 Docmost 官网将其描述为可本地部署、适合企业的 wiki，拥有 300万+ 次下载，并表示受到包括 维尔纽斯市 、Bechtle 、澳大利亚政府 、红十字会 和 ETS Quebec 在内的团队信任。 该漏洞存在于 Docmost 也用于图表保存/更新流程的通用文件上传路径中。...

Linux Distros Unpatched Vulnerability : CVE-2026-58301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connectio...

CVE-2026-82634

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint (file: print_format_generator.py). Low-privileged users with print permission on any document can supply raw Jinja template strings, enabling arbitrary SELECT statements against unrelated table...

EUVD-2026-66771

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...