CVE-2018-11776

Contenedor Docker vulnerable para CVE-2018-11776 root@kitploit: docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 root@kitploit: Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result :...

CVE-2026-3288-lab

CVE-2026-3288 Laboratorio Vulnerable Docker Inyección de Configuración en NGINX Ingress Controller ⚠️ ADVERTENCIA : Este laboratorio contiene configuraciones intencionalmente vulnerables para SOLO ENTRENAMIENTO DE SEGURIDAD AUTORIZADO Resumen de la Vulnerabilidad CVE-2026-3288 CVSS 8.8 ALTO -...

evilarc

evilarc Propósito evilarc te permite crear un archivo zip que contiene archivos con caracteres de traversal de directorios en su ruta incrustada. La mayoría de los programas comerciales de zip winzip, etc. evitarán la extracción de archivos zip cuyas rutas incrustadas contengan caracteres de...

CVE-2024-32019_poc

通过 ndsudo 提权（Netdata 本地漏洞） 这是一个替代性概念验证（POC），利用 Netdata 捆绑的易受攻击 ndsudo 工具进行本地提权。 该漏洞通过在用户 PATH 中插入脚本，将一个允许命令（nvme）替换为 ndsudo 并以 root 权限执行。 前提条件与假设 📜 目标系统上的本地 shell 访问权限 。 目标机器上安装有 Python3。 能够执行 ndsudo 命令。 步骤 1. 脚本 🔨 你可以直接在目标机器上创建或上传脚本，只要脚本名称是允许命令之一即可。 要查看 ndsudo 允许的命令，只需运行 ndsudo --help。 在本 POC...

CVE-2026-31156

CVE-2026-31156 Existe una vulnerabilidad de inyección de rutas en OpenPLC-v3, que surge de que el programa no realiza ninguna comprobación de validez sobre los parámetros de ruta de archivo pasados desde la línea de comandos. Los atacantes pueden leer cualquier archivo legible mediante la...

CVE-2025-48384-test

复现命令行 root@kitploit: git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git 修改指向的GitHub仓库 root@kitploit: git init repo git -C repo -c protocol.file.allow=always submodule add https://github.com/beishanxueyuan/CVE-2025-48384.git sub git -C repo mv sub $printf "sub\r" git...

llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116 — RCE en WebUI de LLaMA-Factory mediante trustremotecode Prueba de concepto para CVE-2026-58116 CVSS 9.8 Crítico: ejecución remota de código en LLaMA-Factory = v0.9.5. La WebUI de LLaMA-Factory tiene hardcodeado trustremotecode=True al cargar un modelo...

cve-2024-32002-poc

💥 CVE-2024-32002 – Git Submodule Path Injection PoC Motivación Durante la resolución de la máquina Compiled de la plataforma Hack The Box, me encontré con un comportamiento curioso relacionado con Git y los submódulos. Al investigar más a fondo, encontré este excelente post del investigador Amal...

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Summary Default SCP remote-path handling places caller-supplied paths into the command that runs scp on the server. On a shell-based server that command is interpreted by a shell, so an attacker-influenced path that is not quoted to suit that shell can execute as a command as the authenticated SS...

GHSA-MGGC-4XG6-VCXF SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Summary Default SCP remote-path handling places caller-supplied paths into the command that runs scp on the server. On a shell-based server that command is interpreted by a shell, so an attacker-influenced path that is not quoted to suit that shell can execute as a command as the authenticated SS...

CVE-2026-85756

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0 , the ScpClient component places caller-supplied remote paths into the command used to run scp on the server. The default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter, s...

CVE-2026-58201

Lokka (@merill/lokka), a Model Context Protocol server for Microsoft 365, is vulnerable to SSRF in versions prior to 2.1.2 . The root cause is in src/mcp/src/main.ts, where the tool constructs Azure Resource Manager request URLs via direct string concatenation with a user-controlled path value. A...

Astra Linux – Vulnerability in libssh

A flaw was discovered in the libssh API function sshscpnew, in versions prior to 0.9.3 and prior to 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a path provided by the user, is executed on the server side. If the library is used in a way that allows user...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then select a new destination path on the controller node. All versions under 2.7.x, 2.8.x, and 2.9.x branches are believed to be vulnerable...

EUVD-2026-76747

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-90446

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-90446

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-90446

CVE-2026-90446 describes an API endpoint that interpolates a user-supplied value directly into the path of a backend request to a search and analytics data store without restricting its contents. An authenticated attacker can substitute an arbitrary backend path, causing the application's own ele...

CVE-2026-90446

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

NPM: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

NPM: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...