389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

Thank-u-Next

Thank u Next – CVE-2025-29927 漏洞利用工具 🧠 什么是 CVE-2025-29927？ 这不仅仅是绕过——这是一种启示。一个被中间件逻辑误解和处理不当的请求头，变成了本应被锁定的资产的万能钥匙。 CVE-2025-29927 利用了配置错误的中间件授权层 ——具体来说，就是那些盲目信任 x-middleware-subrequest 请求头而不验证其来源或上下文的系统。 用简单的话说？ 你只需添加一个请求头，砰——你就进去了。无需认证，无需令牌，只有纯粹的支配。 🚀 漏洞工作原理（技术解析） 1. 漏洞根源： 许多现代 Web 应用使用中间件来拦截和处理 A...

CVE-2018-11510

由 Kyle Lovett（@SquirrelBuddha）和我本人（Matthew Fulton/@haqur）为 CVE-2018-11510 编写的一对漏洞利用程序。它利用一个未认证的命令注入漏洞来反弹一个 root shell。 该 metasploit 模块在仓库中附带了一个单独的 payload。我看看近期能否通过向 MSF 提交 pull request 将它们合并进去。 看起来这个漏洞 可能 已经被修补了，不过我敢肯定还有其他漏洞等着被发现 :D...

cve-2024-8069-exp-Citrix-Virtual-Apps-XEN

CVE-2024-8068 and CVE-2024-8069 Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code Execution Vulnerability Check out our blog post for detailed technical information. https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 Exploit Demonstration root@kitploit:...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress 漏洞利用 未经认证的路径遍历 → 任意文件删除 → 强制重装 → 远程代码执行 概述 CVE-2026-8713 是 WordPress 的 Avada Fusion Builder 插件/主题中的一个 CVSS 9.1 严重漏洞。FusionFormDBEntries 类中的 maybedeletefiles 函数使用简单的字符串替换，从攻击者控制的表单条目值构建文件系统路径——不经过 realpath 验证或目录包含检查。 未经认证的攻击者通过 处理器提交一个路径遍历负载。当...

CVE-2022-23862

CVE-2022-23862: 通过YSoft SafeQ中未经身份验证的JMX实现本地权限提升 SafeQ JMX服务运行在端口9696上，容易受到JMX MLet攻击。由于该服务未强制实施身份验证，并且在“NT Authority\System”用户下运行，我们能够利用此漏洞执行任意代码并提升至系统用户权限。 NVD披露： 该漏洞的披露信息可在此处找到：链接。 要求： 此漏洞需要： 访问TCP端口9696 概念验证： 更多详情及利用过程请参阅此PDF。...

CVE-2021-42558

CVE-2021-42558: MITRE Caldera 中的多个跨站脚本漏洞 Caldera（版本 =2.8.1）包含多个反射型、存储型和自 XSS 漏洞，这些漏洞可能被已认证和未认证的攻击者利用。 厂商披露： 该漏洞的厂商披露可在此处找到。 要求： 此漏洞需要： 部分 XSS 需要有效的用户凭据 概念验证： 更多详情和利用过程可参见此 PDF。 附加信息： XSS 向量“1.1. Agent 中未认证的存储型 XSS”也被并行发现，并由 Daniel "uruwhy" Matthews 在此 Caldera 提交 中修复。...

cve-2026-41042

CVE-2026-41042：Apache Gravitino --metalake NAME --cmd CMD --port PORT 示例： root@kitploit: 默认运行：对 testml metalake 执行 whoami python3 poccve-2026-41042.py http://127.0.0.1:8090 针对指定 metalake 执行自定义命令 python3 poccve-2026-41042.py http://10.0.0.5:8090 --metalake zeroauthml --cmd "ipconfig" 如果 metalak...

CVE-2019-12409

CVE-2019-12409: RCE Vulnerability Due to Bad Defalut Config in Apache Solr The 8.1.1 and 8.2.0 releases of Apache Solr contains insecure setting in the default solr.in.sh configuration file shipping with Solr. The setting that result in this vulnerability are: In "solr.in.sh":...

React2Shell-CVE-2025-55182

🎯 React2Shell（CVE-2025-55182）：React Server Componentsから完全なRCEへ 難易度：中級 → 上級 カテゴリ：Web Exploitation | Deserialization | RCE 🧩 タスク1：はじめに — React2Shellがなぜ重大な問題なのか CVE-2025-55182は、React2Shell というあだ名で知られ、防御側を即座に不安にさせる脆弱性のひとつです😬。2025年12月 に発見され、CVSSスコア10.0 を記録しています。これは、単なるエッジケースのバグではないことを既に示しています。...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io：/api/v1/full-spec 缺少身份验证，泄露完整 OpenAPI 架构 产品： dgtlmoon/changedetection.io — v0.55.7 文件： changedetectionio/api/Spec.py CWE： CWE-306 — 关键功能缺少身份验证 CVSS 3.1： AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3（中危） CNA： Turan Security · CVE 记录 描述 changedetection.io 的 REST API...

CVE-2026-13714

Realtyna WPL 5.3.0 - 未认证 RCE 漏洞利用 描述 此漏洞利用针对 Realtyna Organic IDX + WPL Real Estate 插件 5.3.0 之前的版本中的一个严重漏洞。该插件使用硬编码凭据，并允许未经认证的文件上传，从而导致远程代码执行（RCE）。 漏洞详情 CVE ID： CVE-2026-13714 受影响版本： 5.3.0 类型： 未认证的任意文件上传导致 RCE 研究人员： Thom Stackhouse 技术细节 该插件默认启用了 I/O API，并带有硬编码凭据： iopublickey =...