asnap

Asnap الوصف يهدف Asnap إلى تسهيل مرحلة الاستطلاع recon من خلال توفير بيانات محدثة بانتظام حول الشركات التي تمتلك عناوين IPv4 أو IPv6، ويتيح للمستخدم أتمتة المسح الأولي للمنافذ والخدمات. root@kitploit: █████╗ ███████╗███╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝████╗ ██║██╔══██╗██╔══██╗...

CVE-2024-37010

CVE-2024-37010 استغلال الثغرة CVE-2024-37010: الوصول إلى التخزين الخارجي للمستخدمين الآخرين والحركة الجانبية: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage مقدمة يحول Owncloud الخادم إلى سحابة...

CVE-2026-0023-Update-Ownership-PoC

CVE-2026-0023 - Contournement de la vérification de propriétaire de mise à jour Android PoC Un environnement de laboratoire Android complet pour reproduire et étudier CVE-2026-0023. Ce dépôt montre comment CVE-2026-0023 permet à un installateur classique d'influencer un indicateur d'installation...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

CVE-2024-31969

📌 CVE-2024-31969 CVE-2024-31969 هو ثغرة رفع امتيازات محلية في sudo عند استخدام الأمر sudoedit. هذه الثغرة تم تقديمها منذ sudo 1.9.0 بسبب طريقة تحقق sudoedit من متغيرات البيئة للمستخدم وملكية الملفات بشكل غير صحيح. 📖 الوصف عيب تم تقديمه في sudo 1.9.0 في كيفية تحقق sudoedit من متغيرات البيئة...

CVE-2017-17562

CVE-2017-17562 لم يتم برمجته بواسطتي...

acltoolkit

acltoolkit acltoolkit est un couteau suisse pour les abus ACL. Il implémente de multiples abus ACL. Table des matières acltoolkit Table des matières Installation Utilisation Commandes get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation...

OwnershipStealer

OwnershipStealer هذا الكود بلغة C هو تطبيق وحدة تحكم يحاول الحصول على ملكية ملف محدد. منطق الكود يتحقق البرنامج أولاً مما إذا كان اسم الملف قد حُدد كوسيط لسطر الأوامر، وإذا لم يكن كذلك، يطلب من المستخدم إدخاله. ثم يتابع محاولة الحصول على ملكية الملف بتنفيذ الخطوات التالية: الحصول على رمز token...

CVE-2026-85781

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

EUVD-2026-71692

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781

The Amazon EFS CSI Driver (kubernetes-sigs/aws-efs-csi-driver) before v3.4.1 is vulnerable to unverified ownership of a storage access point in its volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can craft a PersistentVolume volumeHandle that ...

CVE-2026-85697

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85624

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying conversation IDs, resulting in unauthorized modification of pending co...

CVE-2026-85624 Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

EUVD-2026-71231

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

CVE-2026-85624 Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...