RHEL 8 : redis:6 (RHSA-2026:64823)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64823 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

Microsoft Exchange Server (September 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. CVE-2026-55007 - External control of file name...

RHEL 9 : redis (RHSA-2026:64824)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64824 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

NewStart CGSL MAIN 7.02 : cups Multiple Vulnerabilities (NS-SA-2026-0093)

The remote NewStart CGSL host, running version MAIN 7.02, has cups packages installed that are affected by multiple vulnerabilities: - libppd = 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker...

EulerOS 2.0 SP12 : shim (EulerOS-SA-2026-3311)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary:...

PT-2026-88628

Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

ALSA-2026:64796 Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

KLA91272 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, read local files, spoof user interface. Below is a complete...

KLA91268 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

CVE-2026-25212

CVE-2026-25212 – Percona PMM RCE PoC 심각 – CVSS 9.9 – PMM 3.7에서 인증된 원격 코드 실행 설명 이 개념 증명PoC은 PMM 내부 PostgreSQL 사용자가 'SUPERUSER' 권한을 유지하는 취약점을 이용합니다. 인증된 공격자'pmm-admin' 권한 보유는 '데이터 소스 추가' 기능을 남용하여 PostgreSQL의 'COPY ... TO PROGRAM'을 통해 임의의 OS 명령을 실행할 수 있습니다. 영향을 받는 버전: PMM 3.7 수정된 버전: PMM 3.7 이후 요구 사...

CVE-2025-24893

XWiki CVE-2025-24893 Доказательство концепции Авторы : Net.Doge & Infinit3i Этот скрипт на Python эксплуатирует уязвимость CVE-2025-24893 — удаленное выполнение кода RCE в XWiki, вызванное некорректной изоляцией Groovy-макросов, отображаемых асинхронно. Он позволяет выполнять произвольные команды...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — Неаутентифицированная SQLi до RCE Эксплойт типа proof-of-concept, объединяющий две уязвимости FreePBX для перехода от нулевого доступа к удаленному выполнению кода на FreePBX 16...

React-Server-Components-RCE

React Server Components Утилита удалённого RCE 📖 О программе React Server Components Remote RCE Exploitation Tool — это инструмент для тестирования безопасности, специально предназначенный для эксплуатации удалённого выполнения кода в React Server Components и Next.js. Имеет графический интерфейс...

CVE-2025-59528

Version française CVE-2025-59528 개념 증명 Proof of Concept 승인된 환경에서 취약점의 기술적 검증에 초점을 맞춘 최소 PoC입니다. 사전 요구 사항 대상 Flowise 대시보드에 사용자 계정이 있어야 합니다. 해당 계정에 연결된 유효한 API 키가 있어야 합니다. PoC를 실행하기 전에 콜백 호스트에서 리스너를 시작해야 합니다 예: nc -lvn 4444. 사용 예시 먼저 리스너를 시작합니다: root@kitploit: nc -lvn 4444 root@kitploit: python3...

CVE-2026-49952

安装 root@kitploit: pip3 install Pillow torch torchvision 运行 root@kitploit: $ python3 exploit.py http://localhost/discuz5/ +----------------------------------------------------+ | Discuz! X5.0 Remote Code Execution Exploit by EgiX | +----------------------------------------------------+ + Getting...

wp2shell-poc2

wp2shell-poc 인증되지 않은 SQL 인젝션을 WordPress 코어에서 원격 코드 실행으로 연결하는 개념 증명PoC입니다. REST 배치 라우트 혼동CVE-2026-63030을 통해 작동합니다. 이 익스플로잇은 접근 가능한 대상 외에는 자격 증명이나 구성이 필요하지 않습니다. 단일 엔드포인트 POST /wp-json/batch/v1을 통해 인젝션에 도달합니다. 발견 자체는 인증되지 않은 SQL 인젝션입니다. check 명령어가 이를 확인하고, read 명령어가 임의 데이터베이스 읽기를 시연합니다. shell 명령어는...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Интерактивная оболочка перехват HTTP + POST + AES-256-CBC/BASE64 Обнаружение -dnslog DNSLog Обнаружение без вывода Nuclei -poc Обнаружение эха уязвимости Эксплуатация -exp Интерактивная оболочка эхо base64 -exp2 Интерактивная оболочка перехват HTTP +...

ActiveMQ-cve-2026-42588-scanner-gui

ActiveMQ-cve-2026-42588-scanner-gui 【VPS 원클릭 익스플로잇 VPS 보유 사용자 추천】 1. VPS 공인 IP와 리스닝 포트를 입력하세요 예: 9999 2. 실행할 명령어를 입력하세요 예: touch /tmp/cvepwned 3. 【VPS 명령 생성】클릭 → 【명령 복사】클릭 4. SSH로 VPS에 로그인하여 명령을 붙여넣고 Enter를 눌러 실행하세요 5. Serving HTTP on 0.0.0.0:9999 메시지가 보이면 서비스가 시작된 것입니다 6. 도구로 돌아와 【익스플로잇 실행】을 클릭하...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Deep-Dive Углубленный технический анализ CVE‑2026‑41096, критического переполнения кучи в Windows DNSAPI.dll, позволяющего удаленное выполнение кода через поддельные DNS-ответы. Включает векторы атак, анализ патча и рекомендации по защите для команд безопасности. Обзор...