389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

Thank-u-Next

Thank u Next – CVE-2025-29927 Exploit Tool 🧠 What is CVE-2025-29927? It’s not just a bypass — it’s a revelation. A single header, misunderstood and mishandled by middleware logic, becomes a master key to what was meant to be locked. CVE-2025-29927 exploits a misconfigured middleware authorization...

CVE-2018-11510

Un par de exploits para CVE-2018-11510 de Kyle Lovett @SquirrelBuddha y yo mismo Matthew Fulton/@haqur. Aprovecha una inyección de comandos no autenticada para obtener una shell root. El módulo de metasploit tiene un payload separado incluido en el repositorio. Veré si puedo incluirlos mediante u...

cve-2024-8069-exp-Citrix-Virtual-Apps-XEN

CVE-2024-8068 and CVE-2024-8069 Citrix 虚拟应用和桌面 XEN 未认证远程代码执行漏洞 查看我们的博客文章了解详细的技术信息。 https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 漏洞利用演示 root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoami" CVE-xxxx-xxxxx.py Citrix 虚拟应用和桌面...

CVE-2026-8713

CVE-2026-8713 — Exploit de Avada Fusion Builder para WordPress Path Traversal sin autenticación → Eliminación arbitraria de archivos → Reinstalación forzada → RCE Descripción general CVE-2026-8713 es una vulnerabilidad crítica con CVSS 9.1 en el plugin/tema Avada Fusion Builder para WordPress. La...

CVE-2022-23862

CVE-2022-23862: 通过YSoft SafeQ中未经身份验证的JMX实现本地权限提升 SafeQ JMX服务运行在端口9696上，容易受到JMX MLet攻击。由于该服务未强制实施身份验证，并且在“NT Authority\System”用户下运行，我们能够利用此漏洞执行任意代码并提升至系统用户权限。 NVD披露： 该漏洞的披露信息可在此处找到：链接。 要求： 此漏洞需要： 访问TCP端口9696 概念验证： 更多详情及利用过程请参阅此PDF。...

cve-2026-41042

CVE-2026-41042: Apache Gravitino 1.2.1 RCE no autenticado Prueba de concepto autocontenida, solo con la biblioteca estándar, para CVE-2026-41042: ejecución remota de código no autenticada en Apache Gravitino anterior a 1.2.1 mediante el ajuste de conexión INIT de H2 JDBC. Sin cabeceras de...

CVE-2019-12409

CVE-2019-12409：Apache Solr 默认配置不良导致的远程代码执行漏洞 Apache Solr 的 8.1.1 和 8.2.0 版本在随 Solr 提供的默认 solr.in.sh 配置文件中包含不安全的设置。导致此漏洞的设置如下： 在 "solr.in.sh" 中： ENABLEREMOTEJMXOPTS="true"（启用 JMX 服务） 在 "solr.cmd" 中： -Dcom.sun.management.jmxremote.local.only=false（允许远程访问 JMX）...

React2Shell-CVE-2025-55182

🎯 React2Shell CVE-2025-55182: De Componentes de Servidor React a RCE Completo Dificultad: Intermedio → Avanzado Categoría: Explotación Web | Deserialización | RCE 🧩 Tarea 1: Introducción — Por qué React2Shell es un gran problema CVE-2025-55182, apodado React2Shell , es una de esas vulnerabilidade...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Falta de autenticación en /api/v1/full-spec revela el esquema OpenAPI completo Producto: dgtlmoon/changedetection.io — v0.55.7 Archivo: changedetectionio/api/Spec.py CWE: CWE-306 — Autenticación faltante para función crítica CVSS 3.1:...

CVE-2026-13714

Realtyna WPL 5.3.0 - Exploit de RCE no autenticado Descripción Este exploit apunta a una vulnerabilidad crítica en el plugin Realtyna Organic IDX + WPL Real Estate en versiones anteriores a la 5.3.0. El plugin utiliza credenciales codificadas y permite la carga de archivos no autenticada, lo que...

wp2shell

wp2shell - WordPress RCE PoC CVE-2026-63030 + CVE-2026-60137 WordPress 核心中的未认证远程代码执行 作者：JohenLastGen 📌 概述 该工具利用两个关键的 WordPress 漏洞链实现 未认证 RCE ： 漏洞| CVE| 描述 ---|---|--- REST 批量路由混淆| CVE-2026-63030| 绕过验证，传输 SQLi 载荷 WPQuery authornotin SQL 注入| CVE-2026-60137| 原始字符串注入 → SQL 执行 影响： 未认证攻击者 → 创建管理员 → 执行命...