moodle-cve

挑战创建 灵感 moodle CVE-2025-26529: 污染管理员日志以实现完全管理员账户接管 @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU @ref: https://github.com/NightBloodz/moodleTestingEnv @ref: https://medium.com/@Nightbloodz/admin-account-takeover-in-moodle-093708a0f749 初步构想 我有以下 CTF 挑战构想： 1. 创建一个包含三个角色的 Web...

c0ntextomy

c0ntextomy 비공식적 오류informal fallacy이자 잘못된 귀속false attribution의 한 유형으로, 문맥에서 벗어난 인용이 원래 의도를 왜곡하는 방식 Wikipedia - Contextomy 디버그 세션 하이재킹, 원격 코드 실행, 민감한 데이터 유출 취약점을 시연하는 개념 증명Proof of Concept. 권고 macOS/Xcode의 MobileDevice.framework와 iOS/iPadOS/tvOS용 Development Tools의 설계 결함으로 인해, 서비스 연결 설정이 실제 SSL...

soplanning-1.52-exploits

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS 반사 XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

CVE-2026-12704

On Grafana Enterprise instances with the optional IdP-initiated SAML single sign-on enabled allowidpinitiated = true, disabled by default, Grafana did not fully validate the InResponseTo field of SAML responses. An attacker who obtained a valid, signed SAML assertion for a user could replay it...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE 익스플로잇 도구 CVE-2023-41425 이 Python 기반 공격 보안 도구는 WonderCMS 4.3.2 의 원격 코드 실행RCE 취약점CVE-2023-41425을 자동으로 익스플로잇합니다. 악성 ZIP 테마 모듈을 제작하고 JavaScript 기반 XSS 페이로드 를 전달하여 관리자 세션을 탈취하고 PHP 리버스 셸을 배포하는 과정을 간소화합니다. ⚠️ 교육 및 승인된 보안 테스트 목적으로만 사용하세요. 📚 목차 ⚙️ 기능 📥 설치 및 요구 사항 🚀 사용 예제 🧾 인수 참조 🧠 상세 워크플로우...

CVE-2026-75034

CVE-2026-75034 is a SAML assertion replay flaw in Rancher Manager affecting versions before 2.15.1 (also patched in 2.14.5 and 2.13.9). The replay protection introduced to fix CVE-2026-44946 stored consumed assertion IDs in a per-process cache , so in high-availability deployments each replica on...

PyPsPipeJack

PyPsPipeJack このツールは、私の別のツールである OpenPsPipeJack の続編です。こちらはPythonベースで、主にImpacketを使用してLinux上で動作します。 要するに、リモートホスト上でローカル管理者権限を持っていれば、そのホスト上のリモートPowerShellセッションに接続し、そのPowerShellセッション内でコマンドを実行できます。これにより、水平移動（ラテラルムーブメント）の機会だけでなく、特権昇格の機会も得られます。例えば、RBCDやShadow...

Kotaemon-CVE-2025-56526-56527-disclosure

Kotaemon CVE-2025-56526 및 CVE-2025-56527 공개 Kotaemon 정보 패널의 저장형 크로스 사이트 스크립팅과 localStorage의 평문 자격 증명 저장이 결합되어, 단일 악성 PDF 업로드로 전체 세션이 손상될 수 있습니다. 요약 영향받는 제품/버전 : Kotaemon = 0.11.0 커밋 37cdc28 포함 취약점 : CVE-2025-56526 – PDF 콘텐츠 렌더링 시 이스케이프 처리되지 않아 발생하는 저장형 XSS CVE-2025-56527 – localStorage에 평문 사용자...

CVE-2025-34077

CVE-2025-34077 인증되지 않은 관리자 세션 하이재킹 - Pie Register 플러그인 ≤ 3.7.1.4 📌 설명 이 익스플로잇은 Pie Register WordPress 플러그인버전 ≤ 3.7.1.4의 취약점을 대상으로 하여, 인증되지 않은 관리자 계정의 세션 하이재킹 을 허용합니다. 🛡️ 이 도구는 승인된 테스트 및 연구용으로만 사용하십시오. 소유하지 않거나 명시적 테스트 허가를 받지 않은 시스템에서는 사용하지 마십시오. 🧪 개념 증명 🚀 사용법 root@kitploit: python3...

CVE-2026-79786

Coroot versions 1.20.2 through 1.24.5 are affected by an unvalidated redirect URI in the MCP OAuth dynamic client registration endpoint. The endpoint accepts any syntactically valid redirect URI without validation, allowing an unauthenticated attacker to register a client pointing to an attacker-...

EUVD-2026-65698

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their...

CVE-2026-79786 Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their...

EUVD-2026-65441

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

CVE-2026-62283

Nezha Monitoring (a self-hostable server and website monitoring tool) versions 1.14.13–1.14.14 and 2.0.0–2.0.9 contain a cross-tenant session hijack vulnerability. Stream identifiers created by CreateStream in service/rpc/io_stream.go are not bound to their creating user, and the WebSocket endpoi...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

PT-2026-82325

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The filer's TUS resumable-upload handler fails to verify JWT allowed prefixes scoping after a session is created. This allows a low-privilege tenant who obtains another user's session identifier to...