317 matches found
CVE-2018-16167
Installation and Execution Sequence 0. LogonTracer Installation Download the logontracer version 1.2.0, where a vulnerability was found, from dockerhub. root@kitploit: $docker pull jpcertcc/docker-logontracer:v1.2.0 1. LogonTracer Execution Launch it in a container with the following command...
Nostromo_Python3
Nostrom RCE Python3 Exploit Code: Usage: root@kitploit: $ python3 ./exp.py vulnerable.host 8080 id uid=65534 gid=65534...
0day-POC-for-CVE-2024-27173
Poc CVE-2024-27173 Join t.me/SpiderzTM Shodan and FOFA Dorks Use the following dorks to find potentially vulnerable systems: Shodan Dorks: product:"Toshiba e-Studio" "Remote Command" http.title:"Toshiba e-Studio" port:8080 FOFA Dorks: app="Toshiba-e-Studio" title="Toshiba e-Studio" port="8080"...
cve-2018-11776-docker
Contenedor Docker y exploit PoC de CVE-2018-11776 escrito en Go Puedes construir tu propia imagen y ejecutarla: root@kitploit: docker build . -t yourimagename docker container run -it --rm -p 8080:8080 yourimagename O simplemente puedes usar la que creé con cariño para ti: root@kitploit: docker...
CVE-2026-39636-vulnerability-exp
1. Antes de ejecutar aquí, debe abrir burp suite !! Y el puerto predeterminado de burp suite debe ser 8080; si es otro, puede cambiarlo por su cuenta. 2. Descargar las bibliotecas necesarias root@kitploit: pip install websockets==16.0 -i https://pypi.tuna.tsinghua.edu.cn/simple 3. Simplemente...
CVE-2021-44228-VULN-APP
CVE-2021-44228-VULN-APP NOTA: Esta es una máquina virtual vulnerable para mostrar qué es realmente esta vulnerabilidad log4j, ¡y demás! Instalación: root@kitploit: cd CVE-2021-44228-VULN-APP/ docker build -t log4j-shell-poc . docker run --network host log4j-shell-poc Escuchando en el puerto 8080...
CVE-2017-12615
curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...
Improper Access Control
mcppinotserver is vulnerable to Improper Access Control. The vulnerability is due to the MCP server defaulting to an unauthenticated HTTP service bound to 0.0.0.0:8080, which allows an attacker on the network to access MCP tools and exploit the server's Pinot credentials to execute unauthorized S...
CVE-2026-50224
The web administration panel binds broadly to the public IPv6 address space on port :::8080 without default firewall limits, making internal API endpoints reachable over the WAN...
CVE-2026-50224
The web administration panel binds broadly to the public IPv6 address space on port :::8080 without default firewall limits, making internal API endpoints reachable over the WAN...
CVE-2026-50224 Unauthenticated IPv6 WAN Management Exposure
The web administration panel binds broadly to the public IPv6 address space on port :::8080 without default firewall limits, making internal API endpoints reachable over the WAN...
CVE-2026-50224
The web administration panel binds broadly to the public IPv6 address space on port :::8080 without default firewall limits, making internal API endpoints reachable over the WAN...
PT-2026-46176
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The web administration panel binds broadly to the public IPv6 address space on port ':::8080' without default firewall limits. This configuration allows internal...
Acer M6E 安全漏洞
The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the fact that the web management panel is widely bound to the public IPv6 address space at port :::8080, with no default firewa...
Zor-Seviye-xxe-Lab
AltaySec SOC Policy Manager — Zor Seviye Blind OOB XXE Lab...
CVE-2026-42302
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...
EUVD-2026-28850
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution RCE. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to...
GHSA-X92X-PX7W-4GX4 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
Executive Summary A vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack requires two HTTP POSTs to port 8080. The first sets up a...
PT-2026-35032
Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.3 Description An issue in Dgraph allows an unauthenticated attacker to gain full read access to all data in the database when the default configuration is used and Access Control Lists ACL are not enabled. The fla...
GHSA-6FPF-248C-M7WM Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data e.g. SSH keys, ntds.dit or destroying the entire compromised infrastructure, entirely through the operator's own...