CVE-2026-61560 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode SSE=true exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and...

CVE-2026-61560 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode SSE=true exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and...

CVE-2026-61560 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode SSE=true exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and...

CVE-2026-61560

@zereight/mcp-gitlab is a Model Context Protocol (MCP) server for GitLab. Prior to version 2.1.27 , when the SSE transport mode is enabled (SSE=true), all MCP tools are exposed without authentication. The upload_markdown tool reads arbitrary files from the server's local filesystem via an unsanit...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can...

CGA-HPJH-F23P-6XF8

Bulletin has no description...

json_cve_2020_10663

Workaround for CVE-2020-10663 vulnerability in json gem The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system. Users are strongly advised to upgrade to json 2.3.0 or later. Fo...

wordpress-snapcreek

wordpress-snapcreek snapcreekduplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/ Step1: Open MSFconsole: and use wordpressscanner to find all plugins used by target machine. STEP2: Attack using python script: Install/ upgrade pip3 on attacker machine Sudo apt install...

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview Code-Projects...

CGA-XJJ5-5VMV-J42W

Bulletin has no description...

CGA-J3G8-7PR8-G2J4

Bulletin has no description...

CGA-5JFG-F9V5-FJFR

Bulletin has no description...

IMDSpoof

IMDSPOOF IMDSPOOF is a cyber deception tool that spoofs an AWS IMDS service. One way that attackers are able to escalate privileges or move laterally in a cloud environment is by retrieving AWS Access keys from the IMDS service endpoint located at...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

ZeroPoint

ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect and mitigate exploitation of the CVE-2025-53770 zero-day vulnerability in Microsoft SharePoint Server. 🔍 What it Does This PowerShell script is designed to: Detect compromise indicators, such as suspicious .aspx webshells Parse ULS logs to...

Arecibo

Arecibo Endpoint for Out-of-Band Exfiltration DNS & HTTP Authors Juan Manuel Fernández @TheXC3LL & Pablo Martinez @Xassiz DNS Exfiltration Create a new token: root@kitploit: curl localhost:5000/generatedns "htoken": "c008b5dd22817c50441522f917c66743" Now you can use this identificative token to d...

Claude-Skills-Governance-Risk-and-Compliance

Claude Skills for Governance, Risk & Compliance GRC Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, TSA Cybersecurity, ISO 42001 AI Management System, ISO 27701 Privacy Information Management, DORA Digital Operational Resilience, India's Digital...

CVE-2022-23648-POC

PoC for CVE-2022-23648 This is a proof of concept for @fel1x's CVE-2022-23648. Disclosure info here, CVE info here and a blog with some more information and mitigation ideas here. The Containerfile has the info. needed, and you can change the target of the VOLUME to try out different paths. Easie...

CVE-2021-2109

CVE-2021-2109 Weblogic Server Remote Code Execution Vulnerability Reproduction and Analysis In January 2021, Oracle released a security update patch, including 329 new security patches in the Oracle product family. This announcement specifically mentioned the Oracle WebLogic Server security...

creddump7

Information This repo is for my modifications to the original 'creddump' program available at: https://code.google.com/p/creddump/ I did not write the original program. I have combined many patches and fixes I have seen from different forums and user suggestions, as well as modified the usage to...