112076 matches found
Xinuo Openserver 5/6 - Cross-Site scripting
Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...
Odoo <= 15.0 - Cross-Site Scripting
A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...
Atmail 6.5.0 - Cross-Site Scripting
Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter. id: CVE-2021-43574 info: name: Atmail 6.5.0 - Cross-Site Scripting...
WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting
WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. id: CVE-2017-18536 info: name: WordPress Stop User Enumeration =1.3.7 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress Stop User Enumeration 1.3.7 an...
WP DeskLite - Reflected XSS
WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...
AffiliateImporterEb <= 1.0.6 - Reflected XSS
AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...
PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting
There is a Cross Site Scripting XSS vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2. id: CVE-2023-40753 info: name: PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site...
Cherokee HTTPD <=0.5 - Cross-Site Scripting
Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. id: CVE-2006-1681 info:...
Zip-Cracker-
Zip Cracker 此版本仅支持Zip文件 您也可以将此脚本与crunch一同使用 支持跨平台 用法: zipcracker.py 选项 root@kitploit: Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME, --file=FILENAME Please Specify Path of Zip File -d DICTIONERY, --dict=DICTIONERY Please Specify...
CVE-2022-39197-RCE
CVE-2022-39197-RCE Primero Este proyecto fue modificado a partir del proyecto de @its-arun https://github.com/its-arun/CVE-2022-39197 Cuando probé el script, descubrí que el script de frida no podía consultar los datos en el orden normal. El método consiste en modificar el script de frida para...
cve-2023-20198
cve-2023-20198 描述. 1vere$k 针对 CVE-2023-20198 的 POC，基于 Blog 开发。同时根据原始 Cisco 文章 包含对十六进制响应的检查。 该脚本支持两种模式： check 模式，仅对特定 URL 进行连接并检查响应码。如果返回 200 OK 且响应长度小于 32 个符号，则表明您的设备 可能 已被入侵。 exploit 模式。在该模式下，您需要定义用户名、密码以及已入侵配置。 根据 Cisco 文章的建议，增加了 http/https 协议支持。 使用 -h 标志获取帮助。 示例: root@kitploit: git clone...
CVE-2023-20209
在红队行动期间，我注意到互联网上有相当多的 Cisco Expressway，于是开始研究它，但在工作中一直没有时间进一步探索该产品。 最初我想寻找一个认证绕过漏洞来串联成 RCE，但时间不够，最终确定了一个认证后的 RCE。前端 PHP 代码看起来很有进一步利用的潜力…… 这些是我发现 CVE-2023-20209 并通知供应商期间的笔记。 从利用后的进程列表开始，我们可以看到对 /sbin/request-crlupdate 的调用： root@kitploit: root 16449 0.0 0.0 7472 4024 ? S Feb18 0:00 bash...
ElectronVulnerableVersion
Find Electron Apps Vulnerable to CVE-2023-4863 / CVE-2023-5129 This PowerShell script downloads Sysinternals Strings, recursively searches for strings within all .exe files across all drives, and compares the Electron version found with known patched versions below to determine vulnerability to...
CVE-2025-24893
CVE-2025-24893 XWiki Platform 中 RCE 漏洞的 Bash POC 脚本 使用示例： 设置 netcat 监听器： root@kitploit: $ nc -nvlp 然后运行脚本： root@kitploit: $ chmod +x cve.sh $ ./cve.sh 受影响版本： 从 5.4 到 15.10.11 从 16.0.0 到 16.4.1 免责声明 此工具仅用于教育目的。我对任何滥用行为不承担责任。...
POC_CVE-2025-53558
CVE-2025-53558 免责声明 本程序应仅用于授权的安全测试与研究目的，请使用者遵照网络安全法合理使用。 使用者使用该工具出现任何非法攻击等违法行为，与作者无关。 使用 root@kitploit: python3 CVE-2025-53558.py URL...
nlist
nList Un script de Nmap para generar listas de objetivos para usar con diversas herramientas. Instalación Para que el script se ejecute por defecto como parte de todos los escaneos de scripts -sC, debe guardarse en el subdirectorio scripts del directorio de datos de Nmap junto con un archivo...
CVE-2022-46169
CVE-2022-46169 POC Prueba de concepto / script para CTF que explota CVE-2022-46169 en Cacti, versiones =1.2.22 Este script fue escrito para resolver un desafío CTF. Se basó en los siguientes scripts de ejemplo: tenía dificultades para entender qué hacían realmente estos scripts, así que reescribí...
vuln-CVE-2022-41082
漏洞-CVE-2022-41082 https 和 http 对于 HTTP： nmap -p80 --script exchange-vuln-check.nse 对于 HTTPS： nmap -p443 --script exchange-vuln-check.nse 将结果保存到文件 nmap -p80 --script exchange-vuln-check.nse -oN results.txt...
CVE-2025-1974_IngressNightmare_PoC
CVE-2025-1974IngressNightmare poc IngressNightmare Script Un script de Python para automatizar el envío de cargas útiles JSON a una lista de IPs mediante curl, capturando respuestas y dividiéndolas en informes XML de éxito y fallo. Características Envía solicitudes HTTPS POST con una carga útil...