CVE-2026-54433

CVE-2026-54433：Roundcube 纯文本电子邮件存储型 XSS 本仓库包含针对 CVE-2026-54433 的可配置 Python 概念验证代码，这是 Roundcube 纯文本电子邮件渲染器中的一个存储型跨站脚本漏洞。未经身份验证的发送者可以发送精心构造的 text/plain 消息。当已认证的 Roundcube 用户打开或预览该消息时，攻击者控制的 JavaScript 会在 Roundcube 源（origin）中执行。 该 PoC 演示了具体的已认证会话影响，且不收集 Cookie 或消息正文：它会读取一条较早消息的主题，并将该值、Roundcube...

CVE-2023-37598

CVE-2023-37598 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF Overview CVE ID: CVE-2023-37598 Vulnerability Type: Cross-Site Request Forgery CSRF Affected Product: issabel-pbx v4.0.0-6 Severity: Medium Discovered by: Sahil Ojha Disclosure Date: 10/07/2023 Vendor Homepage:...

Citrix-Virtual-Apps-XEN-Exploit

CVE-2024-xxxx Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code execution See our blog post for technical details https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 PoC in Action root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port ...

CVE-2026-69098_exploit

CVE-2026-69098 — ejecución remota de código por deserialización no autenticada en kotaemon Ejecución remota de código no autenticada en kotaemon = 0.12.0 mediante deserialización insegura en la comprobación de conexión de los ajustes de LLM. El fallo El controlador Gradio checkconnection de los...

Iot_Hacking_Camera_0day

IotHackingCamera0day IoT 摄像头 0day AHD DVR ADN-448 在 http 接口上存在未授权缓冲区溢出漏洞。只需浏览 Web 服务器界面，在用户名和密码中输入超大量数据，即可看到摄像头重启。请 观看视频确认 : 祝 IoT 僵尸网络愉快 : 存在漏洞的固件版本可见于上传的图片中 以下是 POC: https://www.youtube.com/watch?v=WCFKuvCplcY...

CVE-2026-82520 parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...

CVE-2026-82520

parsedmarc before 11.0.1 is vulnerable to a Zip Bomb Denial of Service via compressed email attachments. The root cause is that parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incomin...

Phoenix: Unbounded channel joins per transport enables DoS over few connections

Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an...

EUVD-2026-42049

Phoenix: Unbounded channel joins per transport enables DoS over few connections...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher 未认证文件上传远程代码执行 isimage 与 extractfileextension 不匹配 → PHP 多语言文件上传 概述 CVE-2026-13001 是 Podlove Podcast Publisher WordPress 插件版本 ≤ 4.5.1 中的一个严重级别（CVSS 9.8）未认证 任意文件上传漏洞。 该漏洞利用了内部两个以不同方式解析文件扩展名的函数之间的不匹配： isimage 使用 basename，它包含查询字符串 → URL 显示为 ✅（有效图片）...

CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete User Group Disclaimer: This repository is intended for educational and authorized security research purposes only. Do not use this exploit against any system you do not own or have explicit written permission to test...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

CVE: This vulnerability corresponds to CVE-2026-69084. Summary The /api/search/searchEmbedBlock endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous...

CVE-2026-82527

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQ...

CVE-2025-55182-poc

CVE-2025-55182-poc Una prueba de concepto PoC para CVE-2025-55182 , que apunta a una vulnerabilidad de Ejecución Remota de Código RCE no autenticada en Next.js Server Actions. Este exploit abusa de la contaminación de prototipos durante la deserialización de cargas útiles multipart de React Serve...

CVE-2024-21546

UniSharp Laravel Filemanager 未认证 RCE（CVE-2024-21546） 本仓库包含安全评估工具、检测模板以及自动化利用工具包，用于识别和利用使用 UniSharp/laravel-filemanager 包（版本 file-getClientOriginalExtension; if inarray$extension, $unallowedextensions throw new \Exception'File extension is not allowed.'; return $this; 当攻击者上传名为 poc.php. 的文件时： Symfo...

nginx-cve-2026-42945-poc

CVE-2026-42945 — NGINX Rewrite Module Heap Buffer Overflow → RCE RCE confirmed successful — via heap overflow + GDB process injection, execute arbitrary commands in NGINX / OpenResty worker processes. Quick Start root@kitploit: One-click build NGINX image + execute RCE test ./run.sh nginx One-cli...

CVE-2026-83548-SonicWall-SMA1000-Analysis

CVE-2026-83548 — SonicWall SMA1000 漏洞分析 一个探索真实世界漏洞、其潜在影响以及安全团队如何检测、修复和验证该问题的网络安全项目。 项目概述 本项目是我网络安全学习旅程的一部分。 我选择了 CVE-2026-83548 ，这是一个影响 SonicWall SMA1000 系统的严重漏洞。我研究了该漏洞是什么、它可能如何被利用、为什么对组织很重要，以及防御者应如何应对。 我开展此项目的目标是理解网络安全专业人员如何分析真实世界的漏洞，并以清晰、简单的方式传达安全风险。 快速概览 详情| 信息 ---|--- CVE| CVE-2026-83548 厂商|...

CVE-2023-45866_WIP

h0nkbtexploit 三星设备存在一个严重的蓝牙安全漏洞，攻击者可借此像通过蓝牙键盘连接一样控制目标设备，并根据终端类型远程执行各种功能。该漏洞编号为 CVE-2023-45866，影响 macOS、iOS、Android 和 Linux 设备平台。其原理是诱骗蓝牙主机状态机在未经用户确认的情况下与伪造键盘进行配对。 在 Android 设备上，只要蓝牙处于开启状态，该漏洞即可被利用。不过，三星已为大多数受影响设备发布了补丁，但部分较旧机型可能无法获得更新。 为降低风险，建议用户安装最新的可用安全补丁，并仅在确有必要时开启蓝牙。 此外，三星的移动及可穿戴处理器（包括 Exynos...

CVE-2025-20362-Cisco-Scanner

CVE-2025-20362 Scanner A safe, non-destructive Python scanner for Cisco ASA / FTD WebVPN Authentication Bypass CVE-2025-20362. CVE-2025-20362 allows unauthenticated attackers to bypass authentication and access restricted WebVPN resources through path traversal / normalization flaws. Overview Thi...