second-order

Second Order 扫描Web应用程序以寻找二次子域名劫持漏洞，通过爬取应用并收集符合特定规则或以特定方式响应的URL（及其他数据）。 安装 从二进制文件安装 从发布页面下载预构建的二进制文件并解压。 从源码安装 推荐使用Go 1.17版本。 root@kitploit: go install -v github.com/mhmdiaa/second-order@latest Docker root@kitploit: docker pull mhmdiaa/second-order 命令行选项 root@kitploit: -target string 目标URL -config...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

CVE-2026-54790

The open-source invoice management application InvoicePlane (prior to version 1.7.2 ) is vulnerable to a second-order SQL injection within the Custom Fields module . The root cause is the lack of validation for the administrator-controlled custom_field_table value. The Mdl_custom_fields::used() f...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

Fortigate-SSL-VPN-Exploit-Kit

Kit de FortiGate SSL-VPN recuperado en la naturaleza Archivo de investigación. Recuperado tal como se encontró. Yo no escribí estos archivos. Publicado: 1 de septiembre de 2026 Este repositorio es el orquestador, los payloads de segunda etapa y los listeners de operador que se sitúan sobre un...

CVE-2026-27470

⚠️ YASAL UYARI / LEGAL DISCLAIMER Bu araç yalnızca eğitim amaçlı ve yazılı izin alınmış güvenlik testleri için geliştirilmiştir. Sahip olmadığınız veya test etmek için açık yazılı izniniz olmayan sistemlere karşı kullanılması yasadışıdır. Yetkisiz erişim, birçok ülkede ağır cezai yaptırımlara...

CVE-2026-27470-POC

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection PoC Author:d3vn0mi | CVSS 8.8 | Authenticated | Events Permission Required Overview CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder's web/ajax/status.php — specifically the getNearEvents function...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-93589

A flaw was found in ImageMagick. This vulnerability, located in the FLIF encoder, is caused by an incorrect value for 'ticks per second' in an image being encoded. This can lead to a division-by-zero error, causing the encoder to crash and resulting in a denial of service, which means the softwar...

CVE-2018-6376

CVE-2018-6376 Joomla!, Second Order SQL Injection Start Joomla! root@kitploit: $ docker-compose up -d Access localhost via browser http://localhost:10080...

EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop Second-Order SQL Injection Lab Prerequisites Docker Engine 24+ with Docker Compose v2+ 2 GB free RAM Deploy root@kitploit: cd EverShop-Lab/ docker compose up Wait 2 minutes for first build clones EverShop v2.1.0, compiles, runs migrations, seeds data. App will be availab...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak Forgot-Password Flow Authentication Bypass PoC Proof of Concept for CVE-2026-18963 , a flaw in Keycloak's "Forgot Password" / credential-selection flow that allows an attacker to reach the UPDATEPASSWORD step — and reset a target account's password — without properly...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible en Docker Inyección SQL de segundo orden no autenticada en All-in-One WP Migration and Backup WordPress que escala a filtrado de la ai1wmsecretkey y, con ella, a ejecución remota de código RCE. Lee esto en: English · Español...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2022-21894-Payload

This is a simple example payload for CVE-2022-21894 that demonstrates how an attacker could map a second stage payload in order to be able to call EFI services. A writeup of this vulnerability can be viewed here: https://github.com/Wack0/CVE-2022-21894. The code in this repository extends the PoC...