stegcrack

Stegcrack Stegcrack은 Steghide의 취약점특히 CVE-2021-27211을 악용하기 위한 오픈소스 프로그램입니다. Stegcrack은 주어진 파일에 Steghide로 숨겨진 데이터가 포함되어 있는지 감지하며, 때로는 비밀번호 없이 숨겨진 데이터를 완전히 추출할 수 있습니다. 설치 이 저장소를 클론하세요 root@kitploit: git clone https://github.com/b4shfire/stegcrack 소스 디렉터리로 이동하세요 root@kitploit: cd stegcrack/src 프로그램을...

CVE-2026-47624

NVIDIA DGX Spark contains a CWE-693 (Protection Mechanism Bypass) vulnerability in its UEFI firmware. A privileged local user can exploit this flaw to bypass administrator password protection in the UEFI environment. The CVSS v3.1 score is 6.0 (MEDIUM) , reflecting a local attack vector, low comp...

EUVD-2026-65606

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

perl-CVE-2013-1775

CVE-2013-1775 Apple Mac OSX 10.8.4 - 特权提升 CVE-2013-1775 Apple Mac OSX 10.8.4 特权提升漏洞的 Perl 版本利用程序。 参考资料： https://www.exploit-db.com/exploits/27965/ https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb http://www.exploit-db.com/exploits/27944/...

CVE-2021-36808

CVE-2021-36808 本地攻击者可通过竞争条件绕过 Sophos Secure Workspace for Android 9.7.3115 之前版本的应用密码。 安全公告： https://www.sophos.com/en-us/security-advisories/sophos-sa-20211029-ssw-pw-bypass 详细分析： https://ctulhu.me/posts/sophos-secure-workspace-app-password-bypass/...

coldfusion-10-11-xss

ColdFusion 10.x 11.x XSS - RCE PoC 익스플로잇 이 저장소는 ColdFusion 설치 시 원격 명령 실행을 가능하게 하는 CVE-2015-0345APSB15-07에 대한 XSS 벡터를 포함합니다. 이 익스플로잇은 ColdFusion 10 및 11 설치에만 유효합니다. 구체적으로 ColdFusion 11, 업데이트 11 및 ColdFusion 10, 업데이트 16은 이 두 문제를 모두 수정합니다. 이 공개에 대한 자세한 정보는 여기에서 확인할 수 있습니다. Payload 1 이 페이로드는 ColdFusi...

CVE-2026-66916

JoomGallery の JSON 形式によるパスワード保護カテゴリのバイパス JoomGallery ≤ 4.3.0-stable — 未認証の攻撃者がパスワードゲートをバイパスして保護された画像をダウンロード可能 概要 JoomGallery のカテゴリ JSON ビューに、未認証のアクセス制御バイパスが存在します。ギャラリーカテゴリがパスワードで保護されている場合、HTML ビューはパスワードゲートを正しく強制しますが、JSON ビュー（format=json）はこのチェックを完全にスキップします。...

copyfail-alpine

이것은 Copy Fail LPE CVE-2026-31431의 더 경량화된 포트로, /etc/passwd의 첫 몇 바이트를 패치하여 root로 su할 때 비밀번호가 필요 없게 만듭니다. 이는 원본 익스플로잇의 전체 크기를 줄이고 이식성을 높입니다. Alpine과 같은 배포판은 glibc 링크와 독립형 su 바이너리 대신 busybox/musl을 사용하므로, 원본 바이너리 패치 방법은 일반적으로 작동하지 않습니다. 저는 특히 Alpine에서 작동하는 포트를 만들고 싶었지만, 이 방법은 취약한 커널이 있는 거의 모든 배포판에서 기본...

CVE-2026-66916

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-66916

JoomGallery (a Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 contain an unauthenticated access control bypass in its category JSON view. When a gallery category is password-protected, the HTML view correctly enforces the password gate, but the JSON view (format=json) skips t...

CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

EUVD-2026-64249

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

EUVD-2026-64186

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

unshackle

Конец поддержки ⚠ Проект заархивирован и больше не будет разрабатываться из-за времени, необходимого для его поддержки и тестирования на VMware на не очень мощном ПК. Unshackle — Инструмент для обхода паролей Unshackle — это инструмент с открытым исходным кодом для обхода паролей пользователей...

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before passwo...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

EUVD-2026-57810

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...

EUVD-2026-57464

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72792 SiYuan before v3.7.4 Information Disclosure via Tag API

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...