CVE-2023-0861-POC

Analyzing and Reproducing the Command Injection Vulnerability CVE-2023-0861 in NetModule Routers NetModule is an Original Equipment Manufacturer OEM of industrial grade routers that are commonly used in critical infrastructure and industrial control systems. On February 24th, 2023, ONEKEY, a...

CVE-2021-39379

VULNERABILIDAD DE INYECCIÓN SQL EN OPENSIS 8.0 CVE-2021-39379 Existe una vulnerabilidad de inyección SQL en la versión 8.0 de openSIS cuando se utiliza MySQL MariaDB como base de datos de la aplicación. Un atacante malicioso puede enviar comandos SQL a la base de datos MySQL MariaDB a través del...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | | |,| || | | ||/ | ,| | || | | ./ || |/ | | || v0.1.0 Kit profesional de pruebas de seguridad para JWT. Analiza, descifra, falsifica y explota JSON Web Tokens con más de 15...

CVE-2023-2516

CVE-2023-2516: Stored XSS Vulnerability in Teampass 3.0.6 - M Nadeem Qazi Hey everyone, I wanted to share with you a vulnerability that I discovered in Teampass, a password management software. I found a stored XSS vulnerability CVE-2023-2516 that allows attackers to inject malicious code into...

eden

Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user...

CVE-2026-82293

Kibana's machine learning feature is affected by an incorrect authorization flaw (CWE-863), allowing an authenticated user to invoke machine learning functionality beyond their authorization scope and consume cluster resources they should not be able to reach. The vulnerability impacts Kibana ver...

CVE-2026-78588

CVE-2026-78588 is a CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerability in Filebeat that can lead to denial of service via excessive memory allocation. An attacker able to reach the HTTP ingestion endpoint can send specially crafted compressed requests that exhaust the pr...

Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

CVE-2021-39377

OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39377 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the Mysql MariaDB database through the vulnerable username= parameter...

CVE-2021-39378

VULNERABILIDAD DE INYECCIÓN SQL EN OPENSIS 8.0 CVE-2021-39378 Existe una vulnerabilidad de inyección SQL en la versión 8.0 de openSIS cuando se utiliza MySQL MariaDB como base de datos de la aplicación. Un atacante malicioso puede ejecutar comandos SQL en la base de datos MySQL MariaDB a través d...

Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)

Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during...

CVE-2026-78587

CVE-2026-78587 is an Incorrect Authorization (CWE-863) flaw in Fleet Server that allows any authenticated agent to interfere with active multi-part upload sessions belonging to other enrolled agents, causing a denial of service of agent upload operations via privilege abuse. Affected versions inc...

CVE-2026-78586

Kibana versions 8.0.0 through 8.19.15, 9.0.0 through 9.3.4, and 9.4.0 through 9.4.1 are affected by a CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerability. An authenticated user with low-level privileges can submit a specially crafted request that causes Kibana to consume ...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-163)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a...

CVE-2020-27976

CVE-2020-27976 Exploit osCommerce Phoenix CE . Esto ha producido los mejores resultados durante las pruebas. Los saltos de línea en el payload se reemplazan con espacios antes de la subida. ================== Fuentes: https://www.tenable.com/cve/CVE-2020-27976...

CVE-2026-78584

An Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access, leading to cross-space information disclosure. T...

Kibana 9.4.4 Security Update (ESA-2026-161)

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges...

CVE-2026-78591

A path traversal vulnerability (CWE-22) in the Kibana Fleet feature allows a low-privileged user to manipulate a subsequent action by a higher-privileged user in the Fleet administration interface, causing unintended resource deletion including accounts with elevated privileges. Affected versions...