EUVD-2026-83178

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2026-77239

WACRM (a self-hostable CRM template for WhatsApp) versions 0.7.0 and earlier have an authorization flaw in flow and automation write routes. The routes authenticate account viewers but fail to enforce the agent role before invoking a service-role database client that bypasses row-level security. ...

supahunter

Supabase Hunter OP 模式 针对 Supabase 实例的高级侦察与利用工具。 SupaHunter 是一款强大的 Python 工具，旨在识别、分析和利用配置错误的 Supabase 项目。它不仅仅是简单的表枚举，还提供深度检查能力、基于 Selenium 的密钥提取以及高级权限提升检查。 主要功能 高级发现： OpenAPI 检查： 自动获取并解析 /rest/v1/，以映射整个数据库架构。 RPC 枚举： 探测隐藏的 RPC 函数（getschema、execsql 等）。 智能暴力破解： 使用 SecLists（自动下载）在 OpenAPI 禁用时发现隐藏表。...

CVE-2024-28000

CVE-2024-28000 - LiteSpeed Cache 权限提升 PoC !WARNING 本仓库仅供教育和研究目的使用 。 仅在您拥有的系统 上或获得明确许可 的情况下使用所提供的 PoC。 未经授权的访问 、利用或滥用本仓库中的任何材料均属违法行为 。 作者对因不当使用而导致的任何损害、滥用或法律后果不承担任何责任 。 概述 CVE-2024-28000 是一个严重的未认证权限提升漏洞 ，影响 WordPress 的 LiteSpeed Cache 插件。该漏洞源于插件爬虫角色模拟功能中基于哈希的弱认证机制 ，允许完全未认证的攻击者冒充 WordPress...

directus-security

directus-security 审计任何 Directus 实例中真正会泄露数据的错误配置——公共角色读取暴露、用户枚举、未认证的版本/模式泄露、GraphQL 内省，以及 search 参数字段枚举预言机——并通过匿名探测 逐项实况验证。其他清单只会告诉你哪里 可能 有问题；本工具会拉取实际数据，展示真实存在的问题。 ⚡ 一行命令即可运行，无需管理员令牌，无需安装： root@kitploit: npx directus-security --url https://your-directus.example.com 🤝 想让我们代劳？ 固定范围审计 — $99 / 24...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin prior to 2.6.0.5 contains a missing authorization check in one of its appointment-deletion functions. This allows users holding the plugin's low-privileged custom Staff role to delete arbitrary appointments , exceeding their intended pe...

EUVD-2026-82678

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

EXPLOIT-CVE-2026-8832

利用漏洞 CVE-2026-8832 一个用于测试WordPress插件WPCode Lite Insert Headers and Footers v2.3.5 中远程代码执行（RCE）漏洞的利用工具。该漏洞源于注册自定义文章类型（CPT）wpcode时未定义自定义capabilitytype。这一疏忽允许任何具有作者角色（或更高）的用户通过XML-RPC在服务器上执行任意PHP代码。 致谢 ：基于 t.me/FanatixLegion 的漏洞分析而创建。 ⚠️ 免责声明 仅限授权安全测试。 未经授权将此工具用于非您拥有的系统是非法的...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells 未授权角色分配 针对影响 Pydio Cells 4.1.2 及更早版本的 CVE-2023-32749 的利用程序。低权限的已认证用户可以创建一个具有所有角色分配的新外部用户，从而获得对该实例中所有单元格和非个人工作区的访问权限。 受影响版本 Pydio Cells 4.1.2 及更早版本 已在 4.2.0、4.1.3、3.0.12 中修复 依赖 root@kitploit: pip install requests 使用方法 从已认证会话中获取一个 Bearer token（开发者工具 网络 任意 /a/ 请求...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS 批量赋值权限提升 📌 项目描述 CVE-2025-2304 是 Camaleon CMS（版本 2.9.1）中的一个批量赋值（Mass Assignment）漏洞，允许已认证用户通过操纵密码更改请求中的 role 参数，将其权限提升为管理员。 🚨 技术漏洞解释 漏洞背景 Camaleon CMS 使用 Ruby on Rails，在 2.9.0 版本中，UsersControllerupdatedajax 控制器存在批量赋值 漏洞。该控制器使用了无限制的 .permit!，允许请求中发送的任何参数直接赋值给用户模型。 攻击向量 1...

ansible-role-cve

Ansible 角色：CVE 此角色用于缓解/修补已定义的CVE。 角色变量 Dirty COW漏洞。http://dirtycow.ninja。默认为false。此缓解措施需要在应用了它的服务器每次重启时运行。 root@kitploit: cve20165195: false 示例剧本 root@kitploit: --- - hosts: localhost connection: local become: true becomemethod: sudo vars: cve20165195: true roles: - ../ansible-role-cve 如何改动此角色...

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...

WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure

Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...