Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

Jira - Incorrect Authorization

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

dinkleberry

Dinkleberry 🫐 Sei una delle 92,000+ persone1 bloccate con un NAS D-Link vulnerabile a CVE-2024-3272 e nessuna patch in vista? Questo strumento utilizza l'exploit stesso per correggere un dispositivo vulnerabile. 1: Vedi la divulgazione originale nei riferimenti Cosa fa Dinkleberry eseguirà un...

New-lib3mf.dll-for-MeshMixer

Nova lib3mf.dll para MeshMixer lib3mf.dll pré-compilada para MeshMixer que inclui um patch backportado para o CVE-2021-21772 e uma versão atualizada do zlib 1.3.1. Substitua o original em C:\Program Files\Autodesk\Meshmixer\ Código fonte incluído, se desejar compilá-lo você mesmo. CVE-2021-21772:...

python-patrol

Python Patrol Escaneie instalações do Python no macOS e execute o script CVE-2015-20107.py para relatar se a correção é necessária Vários destes scripts precisam de permissões de Acesso Total ao Disco e devem ser executados como root para que possam escanear todo o sistema de arquivos do macOS...

kali-nethunter-installer

Kali NetHunter Installer Dieser Kali NetHunter-Installer ist im Grunde nur eine ZIP-Datei, die von build.py aus dem hier enthaltenen Ordnerlayout erzeugt wird. Befolge die folgenden Anweisungen, um die Kali-NetHunter-Installer-ZIP zu erstellen. Alles, was du tun musst, ist, sie über Recovery/TWRP...

text4shell-tools

commons-text-tools Schnelllinks Zum Finden anklicken: Finde commons-text .jar-Dateien und ihre Versionen Aufrufe verwundbarer commons-text-Funktionen Hot-Patch für commons-text .jar-Dateien, um die verwundbaren Verhaltensweisen zu deaktivieren Beispiel für Scan und Patch Übersicht CVE-2022-42889...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – JSON मर्ज पैच में प्रोटोटाइप प्रदूषण प्रोग्राम कोड Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutabl...

smbexec

root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...

CVE-2026-32202

Zero-Click-Erzwingung der Authentifizierung: Das Anzeigen eines Ordners mit der manipulierten .lnk-Datei löst während der Symbolwiedergabe eine UNC-Auflösung aus, wodurch das Opfer zu einer vom Angreifer gesteuerten ausgehenden Verbindung gezwungen wird, die dessen Net-NTLMv2-Anmeldeinformationen...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi Patch-Umgehung Nur zur Verwendung in kontrollierten und eigenen Umgebungen. Nicht gegen Systeme ohne Autorisierung verwenden. Beschreibung PoC entwickelt, um CVE-2021-42013 zu demonstrieren, das in Apache HTTP Server 2.4.50 vorhanden ist. Dies...

letsploit

letsploit letsploit è uno strumento che rileva il livello di patch del sistema locale o di un altro sistema Windows 10, lo confronta con le ultime patch disponibili e trova potenziali vulnerabilità CVE e codice exploit disponibile pubblicamente. Ispirato dai seguenti progetti 1. bitsadmin's WESNG...

icu-74-debian

icu-74-debian Debian-Build-Dateien für icu 74.2 mit einem Patch zur Behebung von CVE-2025-5222 Sie müssen icu74.2.orig.tar.gz herunterladen und extrahieren, um Ihren Quellbaum einzurichten. Klonen Sie dieses Repository irgendwohin mit dem folgenden Befehl :- root@kitploit: git clone...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208: Esecuzione di Codice Remota RCE non autenticata in NextGen Mirth Connect Questo exploit sfrutta una vulnerabilità critica di deserializzazione nel motore XStream di Mirth Connect. Deriva da una patch incompleta per CVE-2023-37679, consentendo l'esecuzione di codice arbitrario non...

Chrome-and-Edge-Version-Dumper

Chrome-and-Edge-Version-Dumper Script Powershell che esporta la versione di Chrome e Edge in un file di testo per determinare se è necessario aggiornare a causa di CVE-2022-1096 Assicurati di modificare i percorsi prima di utilizzarlo e di creare la cartella in cui verrà salvato l'output...

CVE-2022-30190

CVE-2022-30190 WICHTIG Gepatcht ab: Sicherheitsupdates vom 14. Juni 2022 CVE Report Die HTML-Datei muss dem Ziel bereitgestellt werden, z.B. exploit.html Eine einfache Möglichkeit, den Angriff auszuführen, ist das Ausführen von server.py...