CVE-2024-21533-PoC-ggit

Vulnérabilité d'injection d'arguments CVE-2024-21533 dans ggit ggit se décrit comme suit : root@kitploit: Local promise-returning git command wrappers Ressources : Code source GitHub du projet : https://github.com/bahmutov/ggit Paquet npm du projet : https://www.npmjs.com/package/ggit Article...

PDFkit-CMD-Injection

Injection de commande PDFkit Détail CVE-2022-25765 Description Le package pdfkit à partir de 0.0.0 est vulnérable à une injection de commande où l'URL n'est pas correctement assainie. Preuve de concept Démarrer un serveur HTTP root@kitploit: 1- python3 -m http.server 80 Démarrer un écouteur netca...

CVE-2025-49132-PoC

CVE-2025-49132-PoC Preuve de concept pour CVE-2025-49132 pour l'exécution de code à distance dans Pterodactyl Panel -m check Do something funny python3 poc.py -u -m exploit -p -t Détails techniques En analysant le git diff de LocaleController.php entre v1.11.10 et v1.11.11 lien, on constate que l...

CVE-2026-49772

PoC внедрения SQL в The Events Calendar CVE-2026-49772 Описание CVE-2026-49772 — это неаутентифицированная слепая SQL-инъекция в плагине WordPress The Events Calendar. Некорректный валидатор параметров REST validatecallback возвращает замыкание вместо проверки позволяет параметру order в...

CVE-2024-43018

CVE-2024-43018 Attribuer un ID Être officiellement référencé dans CVE - Mitre Index Description Technologies utilisées Source et point d'injection Comment exécuter l'attaque Correctif Auteurs Description Lors de l'investigation pour les thèses https://hdl.handle.net/10316/118126 et...

CVE-2021-43799

CVE-2021-43798 Grafana 8.x - Traversée de chemin sans authentification Tout le crédit revient à j0v et à son tweet https://twitter.com/j0v0x0/status/1466845212626542607 Avertissement Ceci est uniquement à des fins éducatives. Je ne suis pas responsable de vos actions. Utilisez-le à vos propres...

CVE-2023-4771

CKEditor AJAX 샘플의 크로스사이트 스크립팅 취약점 CVE-2023-4771 PoC CKEditor 4 AJAX 샘플의 크로스사이트 스크립팅XSS 취약점 이 문서는 CKEditor를 사용하여 XSS 취약점CVE-2023-4771을 수행하는 방법을 설명합니다. 다음 단계를 진행할 때는 각별한 주의를 기울이십시오: 사전 요구 사항 • CKEditor 인스턴스에 접근 권한이 있어야 합니다. 파일: ckeditor/samples/old/ajax.html. XSS 취약점 수행 단계: CKEditor 샘플 페이지 방문 원하는...

CVE-2023-22884-Airflow-SQLi

Apache Airflow SQL 인젝션 PoC CVE-2023-22884 CVE-2023-22884에 대한 PoC는 Apache Airflow 2.4.0 이전 버전에 영향을 미치는 RCE 취약점입니다. 공식 보고서 설명은 다음과 같습니다: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow, Apache Software...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Exploiter le shell une fo...

CVE-2021-24891-Simulation

Практическая лабораторная среда в контейнере для моделирования и эксплуатации уязвимости межсайтового скриптинга XSS на основе DOM в плагине Elementor Website Builder для WordPress, идентифицированной как CVE-2021-24891. 📖 Об уязвимости Эта лаборатория демонстрирует уязвимость межсайтового...

CVE-2021-35042

CVE-2021-35042 Injection SQL via une entrée non assainie de QuerySet.orderby Configuration : Exécutez ./setup.sh pour la configuration initiale Ouvrez l'image Docker pour initialiser la base de données : docker exec -it containerid /bin/bash Et exécutez les commandes suivantes : root@kitploit:...

CVE-2026-79992

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...

CVE-2026-79992

CVE-2026-79992 affects Emacs TRAMP , where a local attacker can achieve arbitrary code execution by processing maliciously crafted filenames. The root cause is that TRAMP concatenates login arguments (derived from the user field) without proper sanitization before passing them to a local shell . ...

qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...

EUVD-2026-65547

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

CVE-2026-55546

QWED-MCP (a deterministic verification gateway for MCP) is affected by a Critical (CVSS 9.8) remote code execution vulnerability in verify_math_expression() within src/qwed_mcp/engines/math_engine.py. Attacker-controlled expression strings are passed directly to SymPy's parse_expr() without restr...

CVE-2026-55527

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized userid into self.userpath. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitize...

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...

CVE-2026-55527

CVE-2026-55527 is a path traversal vulnerability in PraisonAI (praisonaiagents), a multi-agent teams system. In versions prior to 1.6.58 , the FileMemory constructor (__init__()) joins an unsanitized user_id directly into self.user_path. An attacker supplying ../ sequences or path separators can ...