CVE-2019-20224

CVE-2019-20224 Pandora v7.0NG の認証後リモートコード実行（CVE-2019-20224）用の公式エクスプロイト...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 リモートコード実行 CVE-2020-8813 の公式エクスプロイト Cacti v1.2.8 認証前リモートコード実行 Cacti v1.2.8 認証後リモートコード実行...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift 脆弱性の詳細 HackTheBox - SwagShop で確認された脆弱性 ステージ1 = exploit.py Magento CMS ダッシュボードへの管理者認証情報を取得する ステージ2 = postauth.py exploit.py から取得した認証情報を postauth.py に追加して実行: root@kitploit: python3 postauth.py http://TARGET.SITE/index.php/admin "rm /tmp/f;mkfifo /tmp/f;cat...

CVE-2023-20209

私は、Red Team エンゲージメント中にインターネット上で Cisco Expressway を何台か見かけたため調査を始めましたが、業務中にこの製品をさらに調査する時間はありませんでした。 当初は認証バイパスを探して RCE につなげようとしていましたが、時間切れとなり、認証後 RCE に落ち着きました。フロントエンドの PHP コードはさらなる悪用が期待できそうです……。 これは、CVE-2023-20209 の発見とベンダー通知に関する私のメモです。 悪用後のプロセスリストから、/sbin/request-crlupdate への呼び出しが見られます: root@kitploi...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC CVE-2022-41082 NotProxyShell OWASSRF 취약점의 PoC로, Microsoft Exchange 서버에 영향을 미칩니다. 이는 ProxyNotShell OWASSRF에 대한 사후 인증 RCE이며, 명령 실행을 위해 유효한 자격 증명이 필요합니다. TabShell 취약점CVE-2022-41076을 위한 Powershell PoC 스크립트 추가 TabShell 취약점은 OWASSRF를 통해 성공적으로 접근 권한을 획득한 후 제한된 Powershell 샌드박스를 탈출할 수 있...

CVE-2022-41082-POC

CVE-2022-41082-POC 针对 CVE-2022-41082 NotProxyShell OWASSRF 漏洞的 PoC，该漏洞影响 Microsoft Exchange Server。 这是 ProxyNotShell OWASSRF 的认证后 RCE（Post-Auth RCE），执行命令需要有效凭据。 添加了针对 TabShell 漏洞 CVE-2022-41076 的 Powershell PoC 脚本 TabShell 漏洞是一种权限提升形式，允许你在通过 OWASSRF 成功获得访问权限后，突破受限的 Powershell 沙箱。 受影响版本 Exchange...

CVE-2019-11539

CVE-2019-11539 最初の発見者: Orange Tsai, Meh Chang 作成者: Justin Wagner, Alyssa Herrera 謝辞: Orange, Meh Chang, Rich Warren, Alyssa, Mimir 脆弱性の説明 Pulse Secure Pulse Connect Secure バージョン9.0RX（9.0R3.4未満）、8.3RX（8.3R7.1未満）、8.2RX（8.2R12.1未満）、8.1RX（8.1R15.1未満）、および Pulse Policy Secure...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6、CVE-2023-46865 認証後RCE（スーパー管理者） 脆弱性の説明 Crater Invoiceは適切な入力検証が行われていないため、危険なタイプのファイルを無制限にアップロードできるという脆弱性があります。Base64Mimeチェッククラスは、IDAT画像チャンクに有効なPHPペイロードを埋め込むことでバイパスできます。スーパー管理者権限を持つユーザーは、/api/v1/company/upload-logo で会社ロゴを通じて細工されたペイロードをアップロードできます。 使用方法...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

DEBIAN-CVE-2026-23943

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

VulnCheck KEV: CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2025-49218

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute...

Fedora 42 : roundcubemail (2025-70701de9de)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory. This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix Post-Auth RCE...