304507 matches found
CVE-2026-19401
A flaw was found in NSD. A remote attacker can crash an NSD server child by sending a specially crafted message containing a specific number of DNS Cookie options. This continuous crashing can severely hamper or deny DNS service, leading to a denial of service DoS condition. This vulnerability...
Vitejs-exploit
Vite Exploit CVE-2025-31125 Beschreibung: Nutzt den Path-Traversal-Schwachstelle im @fs-Endpunkt des Vite Development Servers CVE-2025-31125 aus, um über manipulierte URLs auf sensible Dateien wie /etc/passwd und /etc/hosts zuzugreifen. Erstellt von Muhammad Waseem. Verwendung: python...
CVE-2022-21371
CVE-2022-21371 Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Lokale Dateieinbindung root@kitploit: Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor...
CVE-2026-77539
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...
CVE-2026-77540
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...
CVE-2026-80350
OneUptime before version 12.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery path. The host-literal screening in Common/Server/Utils/SSRFProtection.ts (function isBlockedHostnameLiteral) rejects private and loopback IPv4 addresses and a limited set of IPv6 f...
CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...
CVE-2026-80347
mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...
CVE-2026-77540
CVE-2026-77540 is a CRITICAL (CVSS 9.1) vulnerability in UniFi OS Server by Ubiquiti, caused by Improper Input Validation that allows a privileged network attacker to achieve Command Injection on the host device. The attack requires high privileges and no user interaction, with changed scope impa...
CVE-2026-77540
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...
CVE-2026-77539
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...
CVE-2026-77539
CVE-2026-77539 is a critical (CVSS 9.1) Improper Input Validation vulnerability in Ubiquiti UniFi OS Server . An attacker with network access and high privileges can exploit it to perform Command Injection on the host device, leading to high impact on confidentiality, integrity, and availability ...
httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration
A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...
CVE-2026-48769
A flaw was found in Incus, a container and virtual machine manager. A malicious image server can cause the Incus client to write files to arbitrary locations via a crafted response header, potentially leading to command execution as root. Mitigation No mitigation is needed as Incus is not shipped...
POC-CVE-2025-55182
POC-CVE-2025-55182 credito : https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478 root@kitploit: usage: CVE-2025-55182-Exp.py -h -u URL -l LIST -c COMMAND -i --revshell LHOST LPORT -t THREADS --proxy PROXY --timeout TIMEOUT -v Utilizzo root@kitploit: Single target exploit python3...
CVE-2025-55182-Simple-Scanner-main
CVE-2025-55182: Scanner RCE per React Server Components Un toolkit completo per rilevare e sfruttare la CVE-2025-55182 , una vulnerabilità critica di Remote Code Execution nelle applicazioni Next.js che utilizzano React Server Components. Questo repository include uno scanner Bash unificato...
CVE-2025-55182-NextJS-Scanner-React2Shell-PoC
Strumento di Exploitation CVE-2025-55182 Uno strumento completo di ricerca sulla sicurezza per testare la vulnerabilità di Remote Code Execution nei React Server Components di Next.js CVE-2025-55182. Panoramica Questo toolkit fornisce capacità automatizzate di rilevamento ed exploitation per...
redis-post-exploitation
redis-post-exploitation Solo per scopi educativi Riferimenti https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf https://paper.seebug.org/975/ Rogue Server https://github.com/knqyf263/redis-rogue-server Compilazione root@kitploit: $ docker-compose build Esecuzio...
CVE-2025-55182
CVE-2025-55182 Scanner & Exploiter !Warning Dieses Repository ist ausschließlich für Bildungs- und Forschungszwecke bestimmt. Verwenden Sie die bereitgestellten PoCs ausschließlich auf Systemen, die Ihnen gehören oder für die Sie ausdrückliche Erlaubnis zum Testen haben. Unautorisierter Zugriff ,...