148855 matches found
CVE-2026-85427 MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSIONFILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntl...
CVE-2026-85424 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...
CVE-2026-85424 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...
CVE-2026-85424
MOOS core-moos (through version 10.4.0) has a missing authentication flaw in its wire protocol (MOOSDB). Unauthenticated clients can bypass the compile-time protocol string check, connect with arbitrary client names, and execute privileged operations including publish , subscribe , and DB_CLEAR (...
EUVD-2026-58625
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...
CVE-2026-82520
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...
autopwn
autopwn 指定目标并针对它们运行工具集 autopwn 旨在让渗透测试人员的工作更轻松、更一致，允许他们指定想要针对目标运行的工具，而无需在 shell 中输入它们或编写脚本。这个工具在某些考试中可能也会派上用场。 安装 建议您使用 Docker 镜像，并暴露 TCP 5000 端口供 autopwn 客户端连接。这是因为 autopwn Docker 镜像已经配置完成（工具已安装并放置在正确的位置）。 只允许此软件包在回环 IP 地址上监听。如果您让此软件包监听公共 IP，就等于允许任意用户以 root 身份在您的服务器上执行命令。最终将需要 HTTPS...
EUVD-2026-52276
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent publish mode: reader-reachable raw SQL method 2 and unescaped REGEXP method 3 on read-write asset-content DB...
CVE-2026-70553-PoC
CVE-2026-70553 - RCE no autenticado en MaxSite CMS Prueba de concepto para CVE-2026-70553: Ejecución remota de código no autenticada en MaxSite CMS mediante inyección persistente de código PHP en database.php a través del endpoint de instalación. Aviso legal Este PoC es solo para fines educativos...
CVE-2025-67923
CVE-2025-67923 漏洞利用报告 JetEngine = 3.7.7 — 通过 CCT REST API 的未认证存储型跨站脚本（XSS） 日期： 2026年3月11日 CVSS 评分： 7.1（高危） CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L 受影响插件： JetEngine = 3.7.7 插件标识（slug）： jet-engine 修复版本： 3.7.8 CVE： CVE-2025-67923 CWE： CWE-79 研究人员： Bonds（通过 Patchstack） 报告时间： 2025年10月19日...
CVE-2026-39987
CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: root@kitploit: /terminal/ws The endpoi...
CVE-2026-2413
CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - 通过 URL 路径的未认证 SQL 注入 描述 Ally – Web Accessibility & Usability WordPress 插件在 4.0.3 及之前的所有版本中，存在通过 URL 路径触发的 SQL 注入漏洞。原因是 getglobalremediations 方法对用户提供的 URL 参数转义不足，该参数未经正确的 SQL 上下文净化，直接拼接进 SQL JOIN 子句。虽然使用了 escurlraw 来保证 URL 安全，但它无法阻止 SQL...
CVE-2026-54433
CVE-2026-54433：Roundcube 纯文本电子邮件存储型 XSS 本仓库包含针对 CVE-2026-54433 的可配置 Python 概念验证代码，这是 Roundcube 纯文本电子邮件渲染器中的一个存储型跨站脚本漏洞。未经身份验证的发送者可以发送精心构造的 text/plain 消息。当已认证的 Roundcube 用户打开或预览该消息时，攻击者控制的 JavaScript 会在 Roundcube 源（origin）中执行。 该 PoC 演示了具体的已认证会话影响，且不收集 Cookie 或消息正文：它会读取一条较早消息的主题，并将该值、Roundcube...
CVE-2023-37598
CVE-2023-37598 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF Overview CVE ID: CVE-2023-37598 Vulnerability Type: Cross-Site Request Forgery CSRF Affected Product: issabel-pbx v4.0.0-6 Severity: Medium Discovered by: Sahil Ojha Disclosure Date: 10/07/2023 Vendor Homepage:...
Citrix-Virtual-Apps-XEN-Exploit
CVE-2024-xxxx Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code execution See our blog post for technical details https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 PoC in Action root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port ...
CVE-2026-69098_exploit
CVE-2026-69098 — ejecución remota de código por deserialización no autenticada en kotaemon Ejecución remota de código no autenticada en kotaemon = 0.12.0 mediante deserialización insegura en la comprobación de conexión de los ajustes de LLM. El fallo El controlador Gradio checkconnection de los...
Iot_Hacking_Camera_0day
IotHackingCamera0day IoT 摄像头 0day AHD DVR ADN-448 在 http 接口上存在未授权缓冲区溢出漏洞。只需浏览 Web 服务器界面，在用户名和密码中输入超大量数据，即可看到摄像头重启。请 观看视频确认 : 祝 IoT 僵尸网络愉快 : 存在漏洞的固件版本可见于上传的图片中 以下是 POC: https://www.youtube.com/watch?v=WCFKuvCplcY...
CVE-2026-82520 parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...
CVE-2026-82520
parsedmarc before 11.0.1 is vulnerable to a Zip Bomb Denial of Service via compressed email attachments. The root cause is that parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incomin...