smb

root@kitploit: ███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB è un protocollo di rete che consente di condividere file,...

CVE-2018-14847

WinboxExploit Dies ist ein Proof-of-Concept der kritischen WinBox-Sicherheitslücke CVE-2018-14847, die das beliebige Auslesen von Klartextpasswörtern ermöglicht. Blogbeitrag https://n0p.me/winbox-bug-dissection/ Voraussetzungen Python 3+ Dieses Skript wird NICHT mit Python 2.x oder niedriger...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extraindo-Credenciais-de-Usuário-para-Roteador-Hathway Via SPI flash-CVE-2024-44815 Descrição da Vulnerabilidade: Durante a avaliação de segurança do firmware do roteador, observou-se que as credenciais de login do roteador, tanto do portal web quanto do ponto de acesso Wi-Fi, são armazenadas em...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Offenlegung sensibler Informationen über die SPI-Flash-Firmware des Hathway-Routers - CVE-2024-46383 Schwachstellenbeschreibung: Während der Sicherheitsbewertung der Router-Firmware wurde festgestellt, dass sensible Informationen zu den mit dem Router verbundenen Geräten wie Mobiltelefonen, Lapto...

ctf

Cose relative al CTF Indice Le sfide sono collegate nella tabella seguente. Descrizione| Evento/Gioco| Soluzione ---|---|--- Smash The Stack| ---| --- Blackbox| Level 1| Un eseguibile con una funzionalità di "login" con la password in testo semplice nella memoria. Blackbox| Level 2| Un eseguibile...

CVE-2025-63820

CVE-2025-63820 Einreicher: Nicola Giuffrida Informationen Hersteller: TOTOLINK Website des Herstellers: TOTOLINK Modell: A720R Firmware-Version: V4.1.5cu.630B20250509 Firmware-Downloadadresse: TOTOLINK Details zur Schwachstelle Beim Anmelden am Kontrollpanel werden Benutzername und Passwort im...

CVE-2022-42176

PCSecure V5.0.8.xw - L'uso di credenziali hard-coded nei file di configurazione porta all'accesso al pannello di amministrazione Sommario Fornitore: PCTechSoft SAS Prodotto: PCSecure Versionei interessatae: 5.0.8.xw Nome in codice: PapiQuieroPollo00 Vulnerabilità Tipo: Uso di credenziali hard-cod...

WinboxPoC

WinboxExploit Questa è una proof of concept della critica vulnerabilità WinBox CVE-2018-14847 che consente la lettura arbitraria di file con password in chiaro. La vulnerabilità è stata riparata da tempo, quindi questo progetto è terminato e non sarà più supportato o aggiornato. Puoi invece...

CVE-2026-5076

CVE-2026-5076 - ARMember Schwachstelle beim Zurücksetzen des Passworts Informationen zur Schwachstelle Element| Detail ---|--- CVE-ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Betroffene Version| Premium = 7.3.1 Gepatchte Version| 7.3.2 CVSS-Score| 9.8 Kritisch CWE...

solutions

Exploitmatic solutions !License: Apache 2.0https://img.sh...

CVE-2026-54433

CVE-2026-54433: XSS memorizzato nelle email in testo semplice di Roundcube Questo repository contiene una prova di concetto Python configurabile per CVE-2026-54433 , una vulnerabilità di cross-site scripting memorizzato nel renderer di email in testo semplice di Roundcube. Un mittente non...

Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2026-54433: Roundcube plain-text email stored XSS !Explo...

CVE-2026-18097

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

Security Bulletin: IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. (CVE-2026-18097)

Summary IBM® Db2® could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. Vulnerability Details CVEID:CVE-2026-18097 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain...

Millions of cars could be tracked and unlocked by a hidden security flaw

A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187 Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

EUVD-2026-47653

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

The CVE-2026-44187 vulnerability affects the Ansible Lightspeed extension for Visual Studio Code. It allows a local attacker or malware operating with the user’s privileges to read the Google Gemini API key because the extension stores the credential in plaintext in the user’s configuration file ...