WordPress PHPMailer < 5.2.18 - Remote Code Execution

WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted Sender property in isMail transport. id: CVE-2016-10033 info: name: WordPress PHPMailer 5.2.18 - Remote...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution

Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector leading to Remote Code Execution RCE. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

d8-copy-fail-mitigation

Mitigazione CVE-2026-31431 per Deckhouse Kubernetes Platform Lingua: English | Русский | Italiano Informazioni sulla vulnerabilità CVE-2026-31431 è una vulnerabilità nel modulo algifaead del kernel Linux, che espone l'API crittografica del kernel allo spazio utente attraverso la famiglia di socke...

CVE-2022-21449

CVE-2022-21449 Repo zur Demonstration der Generierung einer Base64-Signatur für Anwendungen, die anfällig für „psychische Signaturen in Java“ sind, implementiert in einer Node.js-Umgebung 😅 Stelle vor dem Ausführen sicher, dass der modifizierte Fork von elliptic von...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

check-cve-2026-23111

CVE-2026-23111 Defensives Validierungsskript Übersicht CVE-2026-23111 ist eine Schwachstelle im Linux-Kernel in nftables, die von einem unprivilegierten Benutzer zur lokalen Privilegienausweitung auf Systemen ausgenutzt werden kann, auf denen Benutzer-Namespaces und nftables verfügbar sind.12...

intel-me-research

Reverse Engineering del Firmware Intel ME — Analisi Live di CSME 16.x "Il tuo computer contiene un secondo computer segreto. Lo abbiamo trovato, mappato e documentato ciò che si nasconde al suo interno." 🔥 PROVALO TU STESSO — HECI SPY 🔥 Uno script Python. Zero dipendenze. Parla direttamente con i...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the AV1 RTP packetizer’s ffrtpsendav1 keyframe sequence-header search loop in libavformat/rtpencav1.c. An attacker can make FFmpeg read past the end of an AV1 packet by supplying a crafted AV1 frame with an...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Autoren: Moshe Kol, Shlomi Oberman Reproducer PoC für die heap-basierte Pufferüberlauf-Schwachstelle in FreeBSD dhclient beim Parsen von DHCP-Option 119 CVE-2020-7461. Das Problem befindet sich in der Funktion findsearchdomainnamelen in der Datei...

OpenSSL-1_0_1g_CVE-2015-1791

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson Tutti i diritti riservati. DESCRIZIONE Il progetto OpenSSL è uno sforzo collaborativo per sviluppare un toolkit robusto, di livello commerciale, completo e open source che...

So You Want To Build A Nethunter Kernel

Então Você Quer Construir um Kernel Nethunter Introdução O maior obstáculo para a maioria das pessoas que querem configurar um dispositivo Nethunter é o requisito do kernel. A menos que o seu dispositivo já tenha um kernel pré-construído e mantido, vão dizer-lhe para compilar um você mesmo/a. Já...

CVE-2026-45185

CVE-2026-45185 — Dead.Letter: Exim-Heap-UAF zu Remote-Root CVSS 9.8 Kritisch | Exim 4.97–4.99.2 | Ubuntu / GnuTLS-Builds | Ohne Authentifizierung Vollständiger Artikel mit GDB-Trace, Schritt-für-Schritt-Analyse und globalen Expositionsdaten:...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Gerenciamento Impróprio de Privilégios | Registro não autenticado com função de funcionário escolhida pelo atacante → divulgação de PHI de pacientes Visão Geral Vulnerabilidade crítica no plugin WordPress KiviCare – Clinic &...

CVE-2026-64638

CVE-2026-64638 XSS riflesso sulla schermata di login che porta all'esecuzione di codice PHP — WordPress Core Software: WordPress Core ≤ 7.0.2 tutte le versioni precedenti alla 7.0.3 CVSS: 8.9 Alto CWE: CWE-79 — Neutralizzazione impropria dell'input durante la generazione di pagine web...

CVE-2021-3156-Project

CVE-2021-3156 — Baron Samedit Overflow del Buffer Basato su Heap in sudo → Escalation Locale dei Privilegi Dipartimento di Cybersecurity ITSOLERA | Tirocinio Red Team 2026 root@kitploit: ██████╗ █████╗ ██████╗ ██████╗ ███╗ ██╗ ███████╗ █████╗ ███╗ ███╗███████╗██████╗ ██╗████████╗...

Kernel-exploitation

Kernel-exploitation decompress.sh Datei aus CPIO-Archiv extrahieren root@kitploit: !/bin/sh mkdir fs cd fs cp ../initramfs.cpio.gz ./initramfs.cpio.gz gunzip ./initramfs.cpio.gz cpio -idm ../initramfs.cpio.gz &&\ cd .. &&\ gunzip -f initramfs.cpio.gz &&\ ./run.sh Falls das Archiv ein...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls è un progetto inedito in 2 parti composto da argument spoofing e recupero delle syscall, che abusano entrambi di EH per aggirare gli EDR. Questo progetto include entrambe queste tecniche per fornire una soluzione alternativa alle syscall dirette. Manomissione...

CVE-2026-7777-Rust-Use-After-Free-in-Unsafe-Web-Server

CVE-2026-7777 – असुरक्षित वेब सर्वर में Rust Use‑After‑Free प्रोग्राम कोड Rust root@kitploit: // uafserver.rs - Vulnerable Rust HTTP server with use-after-free use std::sync::Arc, Mutex; use std::thread; use std::io::prelude::; use std::net::TcpListener, TcpStream; struct SharedBuffer data: Vec,...