CVE-2017-5638

CVE-2017-5638 CVE-2017-5638 Pythonで書き直されたエクスプロイト 使用方法: システムにPython3がインストールされていることを確認してください。 "python3 CVE-2017-5638.py URL -c COMMAND" を実行します。 URLエンドポイントは '.action' ファイルである必要があります。 スクリプトを実行する前にパラメータを指定することを忘れないでください。 使用例: 未テスト...

CVE-2025-5840

CVE-2025-5840 CVE-2025-5840 のエクスプロイト（Python 製）by hax / haxerr9 使い方: システムに Python3 がインストールされていることを確認してください。 "python3 CVE-2025-5840.py URL -c COMMAND" を実行してください。 スクリプトを実行する前にパラメータを指定するのを忘れないでください。 使用例: 未テスト このエクスプロイトはラボ環境ではテストされていません。動作しない場合（システム/サーバーが脆弱であると確信しているにもかかわらずエクスプロイトが動作しない場合）は、Issue...

CVE-2020-10199

CVE-2020-10199 エコーバージョン 適当に書いた未テストのバグ root@kitploit: Usage: python http://127.0.0.1:8080 username password 参考：https://www.cnblogs.com/magic-zero/p/12641068.html...

ansible-cve-2023-36845

ansible-cve-2023-36845 CVE-2023-36845 の潜在的な脆弱性を発見するための、シンプルで未テストの Ansible Playbook です。 root@kitploit: ansible-playbook -i inventory cve-2023-36845.yml ansible.cfg を使用して、スキップされたホストが出力に表示されないように制限してください。...

cve-2019-11043.py

cve-2019-11043.py ExploitDBの概念実証のPython移植です。 ExploitDB 48182のPython移植（教育目的のみ） このプロジェクトは、exploit 48182のExploitDB PoCのPython移植です。 学習および研究目的で作成されました。 ⚠ 免責事項 このスクリプトはテストされていません 。そのため、誤りや誤ったロジックが含まれている可能性があります。 このコードは、ローカルのテストマシンなどの安全で管理された環境でのみ 使用してください。 このコードの使用はすべて自己責任 です。...

cve-2025-54236

cve-2025-54236 cve-2025-54236 poc エラーを報告してください テストされていません...

Oracle Linux 8 : .NET / 10.0 (ELSA-2026-54542)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54542 advisory. 10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235478 Tenable has extract...

[SECURITY] Fedora 42 Update: perl-Devel-Cover-1.44-7.fc42

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

[SECURITY] Fedora 42 Update: mingw-gstreamer1-plugins-bad-free-1.26.11-1.fc42

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins that aren't tested well enough, or the code is not of good enough quality...

[SECURITY] Fedora 44 Update: gstreamer1-plugins-bad-free-1.28.1-1.fc44

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins that aren't tested well enough, or the code is not of good enough quality...

CVE-2025-65009

In WODESYS WD-R608U router also known as WDR122B V2.0 and WDR28 admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question. The vendor was notified early about this vulnerability, but didn't respond with th...

CVE-2025-65009 Insecure Password Storage in WODESYS WD-R608U router

In WODESYS WD-R608U router also known as WDR122B V2.0 and WDR28 admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question. The vendor was notified early about this vulnerability, but didn't respond with th...

EUVD-2025-197995

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. The vendor was notified early about this...

CVE-2025-10018

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality languages. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. Th...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-406106)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-406106 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacrubind Syzbot is still reporting quite an old issu...

EUVD-2025-25274

Malicious code in bioql PyPI...

EUVD-2025-25275

Malicious code in bioql PyPI...

EUVD-2025-25277

Malicious code in bioql PyPI...

CVE-2025-54541

QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article. The vendor was notified early about this vulnerability, but didn't respon...

CVE-2025-54543

QuickCMS (CMS) is affected by CVE-2025-54543, a Stored XSS in the page editor SEO functionality via the sDescriptionMeta parameter. The vulnerability allows an admin with privileges to inject arbitrary HTML/JS that is rendered when visiting the edited page. Only version 6.8 has been tested and co...