OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

EUVD-2026-63663

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...

GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

GHSA-9468-V6MJ-FPPW Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Vulnerability Details File: internal/client/handler.go OnClientConnecting, internal/proxy/http.go requestHeaders, internal/proxy/grpc.go requestMetadata, internal/unigrpc/grpc.go Consume Line: handler.go:389,548-552 e.Headers - SetEmulatedHeadersToContext, http.go:131-165 requestHeaders,...

CVE-2025-69600

CVE-2025-69600 저자: Rafael José Núñez Gulías 회사: Iberian Var Group 영향 받는 제품: RayVentory Scan Engine 12.6 Update 8 및 이전 버전 Raynet 권고: RSEC200966 Raynet의 rvia에서 명령 삽입Command Injection 취약점으로 인해 공격자가 getconfig, upload, inventory, oracle 옵션을 통해 명령을 실행할 수 있습니다. 검증은 /opt/rvia/rvia.cfg 설정 파일에서 URL을 가져올 때만...

Exploit for Eval Injection in Langflow

Description Usage python3 poc.py -u -c Without...

CVE-2025-29927-Proof-of-Concept

워크스루 1단계 5분 힌트 대상이 노출하는 네트워크 서비스는 무엇인가요? — — — 해결 방법 root@kitploit: kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p 2단계 5분 힌트 1 랜딩 페이지에는 로그인 페이지만 표시되지만, 웹 서버는 종종 추가 경로를 노출합니다. 힌트 2 Gobuster나 DirBuster와 같은 디렉터리 무차별 대입 도구를 사용해 보세요. — — — 해결 방법 root@kitploit: kali@kali:$ gobuster dir -u http://:/ -w...

CVE-2026-39987 — Updated!

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

flight-risk

flight-risk flight risk /flaɪt rɪsk/ — React의 Flight 프로토콜은 React 서버 컴포넌트의 직렬화 계층입니다. CVE-2025-55182는 Flight의 역직렬화 결함을 악용하여 인증 전 RCE를 달성합니다. 앱이 RSC를 사용한다면, flight risk 입니다. CVE-2025-55182 React2Shell — React Server Components의 CVSS 10.0 사전 인증 원격 코드 실행 취약점을 위한 보안 툴킷입니다. 스캔, 탐지, 연관, 테스트 기능을 제공합니다. 포...

CVE-2026-16723 — Updated!

CVE-2026-16723 Exploit A standalone C++17 implementation for CVE-2026-16723 , a critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83. Requirements Linux or WSL on Windows C++17 compatible compiler GCC 7+ or Clang 5+ CMake 3.10 or newer System packages: libzip-dev zlib1g-dev Debian /...

CVE-2021-27905

CVE-2021-27905 순번| 제목 ---|--- 1| 개요 2| 근본 원인 3| 개념 증명 4| 완화 조치 8.8.2+ 5| 참조 교육 및 연구 목적으로만 사용하세요. 소유하지 않았거나 명시적 허가를 받지 않은 시스템에서 이 코드를 사용하지 마십시오. 저는 오용에 대해 책임지지 않습니다. 개요 이는 Apache Solr /replication?command=fetchindex&masterUrl=http:// Solr 의 ReplicationHandler는 다음을 수행합니다: 1. 요청을 수락합니다. 2. 제공된...

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

In this article 1. Risk to enterprise environments 2. Attack chain overview 3. Mitigation and response recommendations 4. Learn more Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk...

confluence-ognl-rce

CVE-2022-26134 - Atlassian Confluence OGNL RCE This script is a wrapper over an unauthenticated remote code execution via OGNL injection exploit primitive in Confluence Data Center and Server CVE-2022-26314. Vendor advisory Originally inspired by the PoC jbaines-r7/throughthewire. I added the...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass 정보 유출 및 RCE 체인 교육 및 승인된 보안 연구 목적으로만 사용하세요. 이 저장소는 Apache Commons BeanUtils의 CVE-2025-48734 취약점을 재현하고, 특정 조건에서 공격자가 원격 코드 실행RCE으로 확장할 수 있는 방법을 탐색하기 위한 통제된 실습 환경을 제공합니다. 📖 취약점 설명 CVE-2025-48734 는 Apache Commons BeanUtils의 1.11.0 미만 버전2....

CVE-2025-471812-POC

root@kitploit: / | / | / / | / / / |/ // / / / / / / &password= 2. Server authenticates "anonymous" truncated at NULL but writes full payload into session file → returns UID cookie 3. GET /dir.html Cookie: UID= Server loads session file → executes injected Lua → RCE インストール root@kitploit: git...

CVE-2025-32433-available-for-windows

CVE-2025-32433 脆弱性に関する情報: https://nvd.nist.gov/vuln/detail/CVE-2025-32433 POC root@kitploit: kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage: cve-2025-32433.py -h -d --host HOST --port PORT Exploit for CVE-2025-32433 Erlang OTP SSH server. options: -h, --help show this...

CVE-2023-20198-Exploit

Cisco IOS XE 認証バイパス CVE-2023-20198 このリポジトリには、Cisco IOS XE Web UI に影響を与える認証バイパスの脆弱性 CVE-2023-20198 の 概念実証エクスプロイト が含まれています。 この脆弱性により、認証されていない攻撃者 が細工された SOAP リクエストを介して脆弱な Cisco デバイス上で任意のコマンドを実行でき、リモートコマンド実行 、管理者ユーザーの作成/削除 を含むデバイスの完全な侵害 につながる可能性があります。 脆弱性の概要 CVE : CVE-2023-20198 影響を受ける製品 : Cisco IOS ...

-CTT-PAN-OS-EXPLOIT-CVE-2024-340

-CTT-PAN-OS-EXPLOIT-CVE-2024-340 CTT-PAN-OS-Exploit – CVE-2024-3400 CVSS 10.0 with Convergent Time Theory enhancement. Uses α = 0.0302011 temporal dispersion, 33-layer phase resonance cascade, and 11 ns temporal wedge filtering to exploit Palo Alto GlobalProtect command injection. The payload is...