Lucene search
+L

272 matches found

Kitploit
Kitploit
added 2026/08/26 11:11 p.m.2 views

CVE-2016-16113-POC

RCE 획득 - Bludit CMS 익스플로잇 root@kitploit: | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| CVE-2019-17240인증 우회와 CVE-2019-16113임의 파일 업로드를 결합하여 취약한 Bludit CMS 설치에서 원격 코드 실행을 달성하는 자동화된 익스플로잇 도구입니다. ⚠️ 법적 고지 승인된 보안 테스트 전용 이 도구는 합법적인 경계 내에서 수행되는 공인된...

9.8CVSS5.4AI score0.77962EPSS
SaveExploits24References1
Kitploit
Kitploit
added 2026/08/26 10:57 p.m.3 views

CVE-2014-0195

XML-RPC WordPress Brute-Force Exploit-Skript Dieses Repository enthält einen Python-basierten Proof of Concept PoC zum Brute-Forcing von Anmeldeinformationen auf WordPress-Instanzen, die anfällig für CVE-2014-0195 sind, wobei die XML-RPC-Funktion system.multicall ausgenutzt werden kann, um mehrer...

6.8CVSS6.8AI score0.99977EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/08/26 9:51 p.m.2 views

goop

goop Google-Suche-Scraper Hinweis: Es funktioniert nicht mehr. Google hat mir mitgeteilt, dass es kein legitimes Problem sei, als ich es meldete, aber jetzt haben sie es stillschweigend behoben. Inhalt Einleitung Wie funktioniert es? Verwendung Installation Beispiel Rechtliches & Haftungsausschlu...

5.5AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/08/26 9:45 p.m.2 views

cve-2026-8697

CVE-2026-8697: Bypass del limite di tentativi di accesso su TP-Link Archer C64 CVE-2026-8697 è un difetto logico nel sistema operativo del TP-Link Archer C64 chiamato TPOS nel messaggio di debug. Consente a qualsiasi utente non privilegiato connesso al router di aggirare il limite di tentativi...

8.8CVSS8.1AI score0.0051EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/26 7:18 p.m.2 views

requests-ip-rotator

Orgogliosamente sponsorizzato da Swiftproxy Proxy residenziali ad alte prestazioni con un pool di oltre 80 milioni di IP in più di 195 paesi — migliora il tasso di successo delle richieste e riduce i blocchi IP durante la raccolta di dati su larga scala e l'automazione del browser. Perfetto per...

5.6AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/26 6:24 p.m.2 views

batchql

BatchQL BatchQL è uno script di auditing di sicurezza per GraphQL con un focus sull'esecuzione di query e mutazioni GraphQL in batch. Questo script non è complesso e accogliamo con favore i miglioramenti. Quando abbiamo esplorato lo spazio dei problemi degli attacchi di batching GraphQL, abbiamo...

5.3AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/26 7:35 a.m.3 views

CVE-2021-3138

..| Discourse 2.7.0 - CVE-2021-3138 |.. Descrizione : Bypass del limite di richieste che porta al Bypass del 2FA Versione testata : 2.7.0 Tipo di attacco: Remoto Impatto : Bypass del 2FA Fornitore del prodotto : https://www.discourse.org Informazioni aggiuntive : Discourse è una piattaforma di...

7.5CVSS7.3AI score0.03073EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/08/25 4:32 a.m.2 views

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – Bypass do Limite de Taxa via Alias de Batching em GraphQL Código do Programa Exploit em Node.js + Python root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const...

7.8CVSS5.2AI score0.0008EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/25 4:22 a.m.3 views

CVE-2024-25277

CVE-2024-25277 在 MW45APT02.0002 上发现 资源和 PoC 此仓库收录了在分析及发现 CVE-2024-25277 过程中收集的脚本和 PoC。 更多关于该发现的信息请查阅:https://blog.maentechie.com/bypass-rate-limiting-in-tcl-mw45ad-to-achieve-privileges-escalation 发现的问题摘要 速率限制绕过 硬编码令牌和密钥 弱加密 权限提升...

5.4AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/25 3:57 a.m.2 views

CVE-2024-41276

CVE-2024-41276 Bypass de Autenticação do Kaiten Kaiten - um sistema de gerenciamento de workflow. Uma vulnerabilidade no Kaiten permite que atacantes burlem o mecanismo de autenticação por código PIN. O aplicativo exige que os usuários insiram um código PIN de 6 dígitos enviado para seu e-mail...

9.8CVSS5.3AI score0.01073EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/24 5:27 a.m.3 views

xmlrpc-brute

Ferramenta de Força Bruta WordPress XML-RPC Uma ferramenta projetada para testar sites WordPress em busca de vulnerabilidades XML-RPC, tentando forçar credenciais de usuário através da interface XML-RPC. Descrição Esta ferramenta testa instalações WordPress em busca de vulnerabilidades de...

5.3AI score
SaveExploits0
Cvelist
Cvelist
added 2026/08/20 4:16 p.m.26 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS0.00274EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/20 4:16 p.m.10 views

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.6AI score
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 4:16 p.m.10 views

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

7.5CVSS5.5AI score0.00274EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 8:27 p.m.10 views

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/19 8:27 p.m.31 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS0.00428EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/19 8:27 p.m.18 views

CVE-2026-54738

Lemmy , a fediverse link aggregator and forum, is vulnerable to rate limit bypass via X-Forwarded-For header spoofing in versions prior to 0.19.19 and 1.0.0-beta.1 . The root cause is that actix-web's ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client addres...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/19 8:27 p.m.19 views

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

6.5CVSS5.6AI score
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.10 views

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

6.5CVSS5.4AI score0.00428EPSS
SaveExploits0References12
ATTACKERKB
ATTACKERKB
added 2026/08/17 7:31 p.m.12 views

CVE-2026-57485

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

8.5CVSS5.3AI score0.00256EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder