30342 matches found
CVE-2026-53552
Goploy is an open-source automation deployment system (github.com/zhenorzz/goploy). In versions 1.17.5 and prior , the project handlers (Project.AddFile, Project.EditFile, Project.RemoveFile, Project.Edit in cmd/server/api/project/handler.go) accept a project or project-file row ID from the JSON ...
CVE-2025-5304
CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - 缺少授权导致未授权权限提升 🚀 PT Project Notebooks ≤ 1.1.3 — 未授权权限提升 CVE-2025-5304 PT Project Notebooks 版本 1.0.0–1.1.3 的 PoC 与漏洞利用辅助工具：wpnbptonewusersadd 函数缺少授权，允许未认证攻击者通过 admin-ajax.php 将指定用户的权限提升至 管理员 。 🧾 描述 WordPress 的 PT Project Notebooks 插件因函数...
CVE-2019-2215
CVE-2019-2215 免責事項: ここで提供されるコードは教育目的およびデモンストレーションのみを目的としています。このコード（またはその情報、ビルド、リポジトリ内の一切の情報）を違法または非倫理的な目的で使用するいかなる人物についても、私は支持せず、一切の責任を負いません。 クレジット Google Project ZeroのJann Horn氏とMaddie Stone氏による概念実証に基づいています このエクスプロイトを書くことを可能にしてくれたCloudFuzzのワークショップに特に感謝します 別の参考資料を提供してくれたkangtasticにも感謝します 使用法...
gitlab-cve-2026-19478-lab
CVE-2026-19478 — GitLab GraphQL @glintroduced 未认证任意方法调用（验证实验室 + PoC） 针对 CVE-2026-19478 （GitLab CE/EE，CVSS 9.4，严重）的可复现 A/B 实验室与安全 PoC。 未认证的攻击者可以对 GraphQL 解析出的领域对象调用任意零参数 Ruby 方法 — 例如调用 Projectdestroy 来在无凭证的情况下删除公共项目 。 还附带随同一版本修复的姊妹漏洞 CVE-2026-19650 （GraphQL multiplex 查询交换）的 PoC。 仅限授权的安全测试 /...
CVE-2026-10520-10523
CVE-2026-10520, CVE-2026-10523 Ivanti Sentry ⚡ 簡単な使い方 このプロジェクトは、以下のような安全かつ許可された環境でのみ使用してください。 ローカルの仮想マシン Dockerコンテナ 隔離されたラボ環境 許可された侵入テスト環境 セットアップ例: root@kitploit: git clone cd Project use python follow below Create a virtual environment python -m venv venv Activate the virtual environment macOS /...
ROOT-APP-NPM-GHSA-CJMM-F4JC-QW8R GHSA-cjmm-f4jc-qw8r in dompurify - Patched by Root
Root has patched GHSA-cjmm-f4jc-qw8r in the dompurify package for Root:npm. Multiple fixed versions available...
CVE-2025-34157
Coolify削除フローにおけるStored XSS CVE-2025-34157 影響を受けるバージョン: Coolify ≤ v4.0.0-beta.420.6 修正バージョン: v4.0.0-beta.420.7 深刻度: 重大 9.4 CVSS 4.0 ベクトル: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 クロスサイトスクリプティング, CWE-20 不適切な入力検証 概要 プロジェクト削除フローにおけるStored...
CVE-2019-17570
CVE-2019-17570 本项目是 CVE-2019-17570的概念验证项目（POC）...
byob
Questions? Check out the docs or join our Discord support server Disclaimer : This project should be used for authorized testing or educational purposes only. BYOB is an open-source post-exploitation framework for students, researchers and developers. It includes features such as: Command & contr...
Gitlab-CVE-2026-19478
CVE-2026-19478 — GitLab GraphQL @glintroduced 指令注入 GitLab CE/EE 中通过 GraphQL 指令实现的未认证远程代码注入 — 仅需一个 HTTP 请求即可删除任意公共项目 这是一个实战渗透测试实验环境，用于复现 CVE-2026-19478——GitLab GraphQL API 中的一个严重（CVSS 9.4）漏洞。@glintroduced 指令允许未认证攻击者在服务器端对象上执行任意 Ruby 方法——包括项目删除、数据外泄和所有权转移——全程无需任何认证。 该实验环境在 Docker 中运行一个真实存在漏洞的 GitLa...
CVE-2025-26198
🛡️ CVE 披露：CVE-2025-26198 — CloudClassroom-PHP-Project 中的 SQL 注入漏洞 披露日期： 2025年6月18日 CVE ID： CVE-2025-26198 严重性： 严重 CVSS 9.8 🧩 概述 CloudClassroom-PHP-Project v1.0 中存在一个严重的 SQL 注入漏洞，具体位于 loginlinkadmin.php 端点。该应用程序直接将未经过滤的用户输入拼接到 SQL 查询中，使得未经身份验证的攻击者能够绕过身份验证并获取完全的管理员访问权限。 此问题已分配标识符 CVE-2025-26198...
CVE-2026-82679
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...
CVE-2026-82679
An unrestricted file upload vulnerability exists in diem-project/diem (up to version 5.1.3 ), located in the Widget Editor component within the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php. The root cause is an unknown function that fails to properly restrict upload hand...
EUVD-2026-68460
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...
CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...
CVE-2026-82679 diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may ...
EUVD-2026-68459
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...
CVE-2026-82678 diem-project diem Administrative Console actions.class.php executeCommand os command injection
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command...
CVE-2026-82678
diem-project diem (up to 5.1.3 ) contains an OS command injection vulnerability in the Administrative Console component. The affected element is the executeCommand function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php , where manipulation of the dm_command argument allows command ...