CVE-2022-22963

Spring Cloud Function 漏洞CVE-2022-22963 存在 CVE-2022-22963 漏洞的应用程序 CVE-2022-22963 漏洞利用演示 https://user-images.githubusercontent.com/57348147/161266562-51d025f0-54d4-488f-ac50-2317e29bfbdf.mp4 构建 root@kitploit: docker pull me2nuk/cves:2022-22963 docker run -it -p 8080:8080 --name=vuln...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

ble_proxy

BLE HTTP 代理系统 一个基于低功耗蓝牙（BLE）的 HTTP 代理系统，通过 iOS 设备路由网络浏览器流量。这使得浏览器可以利用 BLE 作为传输层，通过 iOS 设备的互联网连接进行网页浏览。 架构总览 root@kitploit: Browser → Windows Proxy → BLE/TCP → iOS/Mock Service → WiFi → Internet ← Windows Proxy ← BLE/TCP ← iOS/Mock Service ← WiFi ← 系统组件 1. Windows 代理（windows-proxy/） 用途 ：充当浏览器的 HTT...

CVE-2022-22963

CVE-2022-22963 针对 CVE-2022-22963 的教育性概念验证自动化工具，已在经授权的 Hack The Box 实验室环境中演示。 概述 CVE-2022-22963 是一个 Spring Cloud Function 漏洞，涉及 spring.cloud.function.routing-expression 请求头。 在易受攻击的配置下，攻击者可滥用 Spring 表达式 语言（SpEL）的求值，通过函数路由机制 调用 Java 功能。 此仓库包含一个 Python 自动化脚本，用于复现 经授权的 CTF/实验室环境中的该漏洞。 CVE ID:...

Blackash-CVE-2025-14558

🚨 CVE-2025-14558 : FreeBSD 中的严重远程代码执行漏洞 IPv6 🧠 概述 CVE-2025-14558 是一个严重远程代码执行 RCE 漏洞 ，影响使用 IPv6 路由器请求服务的 FreeBSD 系统。在处理不受信任的网络输入时存在缺陷，允许攻击者执行任意 shell 命令。 📊 严重性 CVSS v3 评分： 9.8 / 10 🔥 风险等级： 严重 所需权限： 无 用户交互： 无 🎯 受影响组件 rtsol8 rtsold8 使用 IPv6 无状态地址自动配置 SLAAC 的 FreeBSD 系统 ⚙️ 技术细节 恶意的 IPv6 路由器通告 RA...

spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6

//// NO EDITE ESTE ARCHIVO. FUE GENERADO. Los cambios manuales en este archivo se perderán cuando se genere de nuevo. Edite los archivos del directorio src/main/asciidoc/ en su lugar. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-gateway/tree/master.svg?style=svg"CircleCI",...

NoFaxGiven

NoFaxGiven - Esecuzione di codice e persistenza nel servizio FAX di NETWORK SERVICE Un'estensione di routing fax è una DLL che aggiunge funzionalità di routing al servizio fax. Più estensioni di routing fax possono risiedere sullo stesso server. Quando il server fax riceve una trasmissione fax,...

cve-2024-38819-lab

CVE-2024-38819 Kundentresor-Labor Dies ist eine Cloud Foundry-fähige Spring-Boot-Demo für CVE-2024-38819, eine Path-Traversal-Schwachstelle im Spring Framework bei der funktionalen Verarbeitung statischer Ressourcen. Was wurde gepatcht? CVE-2024-38819 wird in Spring Framework gepatcht, nicht dire...

CVE-2024-27198_LAB

Laboratorio CVE-2024-27198 Descrizione TeamCity fornisce una pagina riservata agli amministratori per la gestione dei token che non è protetta da autenticazione. Ciò consente a un utente non autenticato di generare un token di accesso per l'utente amministratore se riesce a trovare l'ID di un...

wp2shell-lab

mini-wp-rest Una reimplementazione compatta e senza dipendenze di una piccola parte dell'API REST di WordPress — sufficiente per servire una raccolta pubblica di post ed eseguire più sotto-richieste in un'unica chiamata. Utile per insegnare come il routing di WordPress, WPQuery e $wpdb si combina...

CVE-2026-51642

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67845

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566

Yamcs , a mission control framework, is affected by a DOM XSS in the /ext URL route (affected versions prior to 5.12.8 and 5.13.2 ). The root cause is that attacker-controlled data in files extension.matcher.ts, extension.component.ts, and app.component.ts is rendered via innerHTML without valida...

CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-51642

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the getMeshRoutingTable function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. Unauthenticated, remote attackers can exploit this to obtain mesh routing information , with no user interacti...

CVE-2026-51642

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

Off-by-one Error

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Off-by-one Error in chain-rule handling due to the rule-skipping logic in java/org/apache/catalina/valves/rewrite/RewriteValve.java...