ludus_xz_backdoor

Rol de Ansible: xz backdoor CVE-2024-3094 para Ludus Un rol de Ansible que instala el xz backdoor CVE-2024-3094 en un host Debian y, opcionalmente, instala la herramienta xzbot. !WARNING ¡Este rol despliega malware a propósito! Sin exponer el host a internet deberías estar a salvo, pero sigue...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

rbac

PHP-RBAC v2.x PHP-RBAC es una biblioteca de autorización para PHP. Proporciona a los desarrolladores Control de Acceso Basado en Roles Jerárquico de Nivel 2 de NIST y más, en la implementación más rápida hasta el momento. Versión estable actual: PHP-RBAC v2.0 Conéctate con nosotros Página...

EUVD-2026-68244

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82658

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php . An authenticated low-privilege user can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID, disclosing that user's future rol...

nimbostratus

Nimbostratus Tools for fingerprinting and exploiting Amazon cloud infrastructures. These tools are a PoC which I developed for my "Pivoting in Amazon clouds" talk, developed using the great boto library for accessing Amazon's API. For more information visit the project page Feel free to report...

jackhammer

Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...

MoodleExploit

Exploit de Moodle Título del Exploit: Moodle v3.4.1 RCE Exploit Google Dork: inurl:"/course/jumpto.php?jump=" Fecha: 15 Marzo 2019 Autor del Exploit: Darryn Ten Página del proveedor: https://moodle.org Enlace del software: https://github.com/moodle/moodle/archive/v3.4.1.zip Versión: 3.4.1...

ansible-role-log4shell

Rol de Ansible - log4shell ⭐ Danos una estrella en GitHub — ¡nos motiva mucho! Encuentra Log4Shell CVE-2021-44228 en tu sistema Este rol intenta encontrar JAR y WAR en el sistema de archivos y en archivos abiertos lsof ⚠️ Su sistema puede funcionar lentamente durante el escaneo debido a un find en...

CVE-2025-6758

Real Spaces - WordPress 物业目录主题 ≤ 3.6 通过 imicagentregister 实现未认证权限提升至管理员 📝 描述 CVE-2025-6758 CVSS 评分： 9.8（严重） WordPress 的 Real Spaces - WordPress 物业目录主题 在所有版本（含 3.6）中，存在通过 imicagentregister 函数进行权限提升的漏洞。 该漏洞源于注册过程中对角色分配的约束不足，允许未认证攻击者在注册新用户时任意指定其角色，包括 Administrator。 这一严重缺陷使远程攻击者能够获得运行存在漏洞主题的 WordPres...

rt_redirectors

Rol de Ansible que permite desplegar rápidamente un redirector en un servidor existente con reglas de proxy modrewrite, Compatible con Debian y Ubuntu, probado en Digital ocean y Azure Consulta threat.tevora.com/automating-redirector-deployment-with-ansible para un blog que recorre los redirector...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2020-14321

CVE-2020-14321 课程注册允许从教师角色提权至管理者角色，最终实现远程代码执行（RCE） 也许有人需要Python脚本，因此我编写了它来进行利用。 如何使用此PoC： How to use this PoC script Case 1. If you have vaid credentials: python3 cve202014321.py -u http://test.local:8080 -u teacher -p 1234 -cmd=dir Case 2. If you have valid cookie: python3 cve202014321.py -u...

Flowise < 3.0.1 - Remote Command Execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

s3-account-search

S3 账户搜索 此工具允许你查找某个 S3 存储桶所属的账户 ID。 要使此功能生效，你至少需要具备以下权限之一： 从存储桶下载已知文件的权限（s3:getObject）。 列出存储桶内容的权限（s3:ListBucket）。 此外，你需要一个可以代入的角色，该角色对你正在检查的存储桶拥有（其中一项）这些权限。 更多背景信息可参见 Cloudar 博客 安装 该软件包可在 pypi 上获取，你可以使用以下命令之一（推荐使用 pipx） root@kitploit: pipx install s3-account-search pip install s3-account-search...

ThunderCloud

ThunderCloud Cloud-Exploit-Framework Verwendung root@kitploit: python3 tc.py -h | | | | | / | | | | | | | | | | | | | | | | | | | ' | | | | ' \ / |/ \ '| | | |/ | | | |/ | | | | | | | || | | | | | | / | | || | | || | | | / || ||,|| ||,||| ||/ ,|,| usage: tc.py -h -ce COGNITOENDPOINT -reg...

CVE-2026-13610

CVE-2026-13610 KiviCare – Sistema di gestione di cliniche e pazienti CWE-269 Gestione impropria dei privilegi | Registrazione non autenticata con ruolo del personale scelto dall'attaccante → divulgazione delle PHI dei pazienti Panoramica Vulnerabilità critica nel plugin WordPress KiviCare – Siste...

EUVD-2026-68134

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...