CVE-2026-93982

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...

The vulnerability of the platform for creating individual web applications in CRM involves a lack of measures to protect the SQL query structure, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2026-92099 WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-92099

WPGraphQL Smart Cache WordPress plugin versions prior to 2.3.2 fail to require authorisation or validate a caller-supplied query identifier before storing a persisted query. This allows unauthenticated users to publish arbitrary GraphQL query documents and claim query aliases (alias squatting) be...

cq

cq Code Query，一个通用的代码安全扫描工具。 CQ 扫描代码中的安全漏洞以及安全导向的代码审查人员感兴趣的其他项目。 它将包含所发现问题引用的文本文件输出到一个输出目录。这些输出文件随后可以被审查， 通过 unix 命令行工具（如 grep）进行过滤，或者作为一种“跳转”到代码库中指定 file:line 引用的手段。 一种流行的用法是将输出文件视为“待办事项”列表：在审查过程中删除那些被认为是误报的引用， 或者将引用复制到某个报告文件中，以便详细审查或作为 bug 报告的基础。 该工具极其基础，主要依靠手动操作，并假定使用者对应用程序安全漏洞和代码审查有深入了解。...

CVE-2019-7642

CVE-2019-7642 mydlink機能を搭載したD-Linkルーターには、認証を必要としないWebインターフェースがいくつか存在します。攻撃者はリモートでユーザーのDNSクエリログとログインログを取得できます。 脆弱な対象は、最新のファームウェアバージョンであるDIR-817LW A1-1.04、DIR-816L B1-2.06、DIR-850L A1-1.09、DIR-868L A1-1.10 などに限りません。 PoC1: http://target/mydlink/getLogDnsQuery.asp PoC2:...

hacks

Hacks Hacky one-off scripts, tests etc...

cve-2017-12629

README Apache Solr 7.1 より前 Apache Lucene 7.1 より前 では、XXE と Config API の add-listener コマンドを組み合わせて RunExecutableListener クラスに到達することで、リモートコード実行が発生します。Elasticsearch は Lucene を使用していますが、この脆弱性の影響を受けません。なお、XML 外部エンティティ展開の脆弱性は XML Query Parser で発生します。これはデフォルトで、deftype=xmlparser...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-SQL-Injection OpenSource ERP アプリケーションにSQLインジェクションの脆弱性があります。 CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - データベース名の取得 root@kitploit: POST /db/utils/query/data.xml HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

JSONPath

（另请参阅 开发依赖的许可证） JSONPath Plus 分析、转换并从 JSON 文档（以及 JavaScript 对象）中选择性地提取数据。 jsonpath-plus 在原始规范的基础上进行了扩展，新增了一些额外的运算符，并明确了原始规范未明确说明的一些行为。 试试浏览器演示或 Runkit Node。 请注意：本项目目前没有积极维护。我们可能会接受有良好文档的 PR 或一些简单的更新，但不打算自行修复问题或添加新功能。 功能 符合 原始 jsonpath 规范 原始规范未提供的便捷添加或补充 ： ^ 用于获取匹配项的父级 用于获取匹配项的属性名 （以数组形式） 类型选择器...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - 通过 GitHub 认证中的 CSRF 实现账户接管（PoC） CVE-2022-24342 使用要求 使用方法 工作原理 GitHub OAuth2：查询参数处理顺序 CVE-2022-24342：HTTP 请求流程 使用要求 JetBrains TeamCity 如果在本地机器上运行该漏洞利用工具，你可能需要使用 Ngrok 或替代方案。 root@kitploit: $ ngrok http 8000 2. 创建 GitHub OAuth2 应用： root@kitploit: homepage:...

idamcp

IDA Pro MCP Server This project provides a Model Context Protocol MCP server for integrating IDA Pro with AI agents like Gemini, Claude, and Jetski. It features a gateway-based proxy architecture, an embedded relational SQLite query engine, and headless session management to support advanced...

Persistence-Survivability

永続性生存性評価 このプロジェクトは、Duquスタイルの永続性をTTPとして使用しており、Bsides Augusta – RATで発表されました。このプロジェクトはPowerShellベースであり、資格情報ありとなしの両方で使用できます。詳細については、.ps1ファイルをお読みください。 基本的な使用方法： root@kitploit: Invoke-FindPersitence Invoke-FindPersitence -MaxHosts 100 -Top 5 Invoke-FindPersitence -Domain tester.org -OperatingSystem 7...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. id: CVE-2018-6605 info: name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection author: DhiyaneshDk severity...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...