CVE-2025-68613

CVE-2025-68613 — n8n कामप्रवाह स्वचालन अभिव्यक्ति इंजिन पृथक्करण विफलता लेखक इस शोध के दुरुपयोग या क्षति के लिए कोई जिम्मेदारी नहीं लेता है केवल शैक्षिक और रक्षात्मक उद्देश्यों के लिए प्रदान किया गया है विवरण इस रिपॉजिटरी में एक प्रयोगशाला-स्तरीय विश्लेषण और भेद्यता CVE-2025-68613 के लिए एक...

CVE-2026-58096

CVE-2026-58096 is a missing length validation in the LcpDecodeConfig() function of FreeBSD's ppp(8) user-space PPP implementation. When processing Multilink PPP endpoint discriminator options, the function failed to validate the received option length against the minimum required by RFC 1717 , al...

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...

Lab-for-cve-2018-15133

Riepilogo: MExploiting CVE-2018-15133 Vulnerabilità di deserializzazione Questo exploit sfrutta una vulnerabilità di deserializzazione nel framework Laravel fino alla versione 5.5.40 e nelle versioni 5.6.x fino alla 5.6.29. Descrizione L'esecuzione di codice remoto potrebbe verificarsi a seguito ...

CVE-2019-11447_CuteNews-AvatarUploadRCE

CVE-2019-11447 Exploit/PoC - CuteNews 2.1.2 Avatar upload RCE Autenticato Codice exploit per CVE-2019-11447 noto anche come CuteNews 2.1.2 Avatar upload RCE Autenticato Link dell'exploit: Risultato atteso: accedere/registrare un account, creare un file PHP scelto dall'utente con magic bytes .gif,...

CVE-2021-41773_42013

CVE-2021-41773 e CVE-2021-42013 - Configurazione del Laboratorio Configurazione root@kitploit: $ git clone https://github.com/vulf/CVE-2021-4177342013 $ cd CVE-2021-4177342013 cd to the directory of your choice $ docker build -t vulnapache . $ docker run -d vulnapache NOTA: I file httpd.conf sono...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Hook di installazione di pacchetti PyPI dannosi esecuzione di setup.py Codice del programma Python root@kitploit: setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup...

CVE-2024-8232

CVE-2024-8232 – Vulnerabilità di caricamento file nel Web Server SpiderControl SCADA Riepilogo Il Web Server SpiderControl SCADA è vulnerabile a caricamenti di file arbitrari non autenticati, consentendo agli aggressori di caricare script dannosi ad es. web shell e ottenere l'esecuzione remota di...

CVE-2018-11235

CVE-2018-11235 Erste Schritte Um die Docker-Container zu bauen, verwenden Sie: root@kitploit: make docker Die folgenden make-Befehle sollten parallel auf verschiedenen Terminals auf Ihrer Maschine ausgeführt werden Um den Container des Angreiferservers zu starten, verwenden Sie: root@kitploit: ma...

ICT287_CVE-2022-30190_Exploit

ICT287CVE-2022-30190Exploit Progetto sullo sfruttamento e sulle strategie di mitigazione della vulnerabilità CVE-2022-30190 📌 Informazioni Questo repository contiene il mio progetto finale per ICT287, in cui esploro la vulnerabilità CVE-2022-30190 "Follina". Il progetto comprende: Analisi...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der Verbreitung von WannaCry Für diese Übung bestand das Ziel darin, eine weitere bekannte reale Schwachstelle zu triagieren, diesmal EternalBlue, den SMBv1-Fehler, der bekanntermaßen beim WannaCry-Ransomware-Ausbruch ausgenutzt wurd...

CVE-2015-1578-PoC

CVE-2015-1578-PoC Übersicht Dies ist ein Proof-of-Concept-Exploit für CVE-2015-1578 , eine Pufferüberlauf-Schwachstelle in Achat 0.150 beta7 unter Windows. Die Ausnutzung führt über ein manipuliertes UDP-Paket zur Remote-Codeausführung. Zweck Dieser PoC soll als sauberes, minimales und gut...

CVE-2017-15944-POC

CVE-2017-15944-POC POC per CVE-2017-15944 esecuzione remota di codice root nei firewall Palo Alto Networks Utilizzo root@kitploit: python panos-poc.py https://panip...

QNAP Photo Station < 6.0.3 - Remote Code Execution

QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution RCE. id: CVE-2019-7194 info: name: QNAP Photo Station 6.0.3 - Remote Code Execution author: x-stp severity: critical description: | QNAP Photo...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

VMware vRealize Log Insight - Path Traversal

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. id: CVE-2022-31706 info: name: VMware vRealize Log Insight - Path Traversal...

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. id:...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...