CVE-2026-73314

CVE-2026-73314 XenForo 2.3.13 之前的版本在 PayPal REST webhook 指定不支持的签名算法时会错误地放行。 发生了什么 Webhook 处理器通过一个小型允许列表映射 PAYPAL-AUTH-ALGO。如果该值未知，映射的算法将变为 null。验证路径不会拒绝请求，而是记录算法不可用并返回成功。证书获取和 opensslverify 永远不会被执行。 在启用了 PayPal REST 定期升级的情况下，买家可以从自己的定期升级控件中获取购买请求密钥。一个伪造的 PAYMENT.CAPTURE.COMPLETED...

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket 连接走私 概述 反向代理和后端对如何解析带有畸形 WebSocket 升级头的 HTTP 请求存在分歧。代理将其视为一个请求，而后端将其解释为两个，从而允许攻击者走私一个隐藏请求。这可能导致缓存中毒或访问控制绕过。 漏洞详情 类型： 连接走私 / 请求拆分 影响： 未授权访问内部端点，缓存中毒。 根本原因： 代理在未规范化请求的情况下转发该请求，后端对 Upgrade 头的 WebSocket 检测触发后，将后续数据作为新的 HTTP 请求处理。 漏洞利用演示 1. 启动代理和后端： root@kitploit: python...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r 针对 GHSA-c4j6-fc7j-m34r / CVE-2026-44578 的带内（in-band）验证器 —— Next.js 中经由 WebSocket 升级请求实现的服务器端请求伪造（SSRF）。 ⚠️ 仅限已获授权的安全测试。你需自行确保拥有对传入本脚本的每个目标进行测试的权限。 漏洞详情 字段| 值 ---|--- CVE| CVE-2026-44578 GHSA| GHSA-c4j6-fc7j-m34r CWE| CWE-918 SSRF CVSS v3.1| 8.6 高 —...

CVE-2024-6387fixshell

CVE-2024-6387fixshell 只影响8.5p1 = OpenSSH 9.8p1 安装编译依赖 root@kitploit: sudo apt-get update sudo apt-get install -y build-essential zlib1g-dev libssl-dev 下载指定版本源码 root@kitploit: wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz 解压并进入目录 root@kitploit: tar -xzf...

pulsar-docker-images-patch-CVE-2021-44228

使用 Apache Log4J 2.17.1 升级修补 Pulsar 镜像 涵盖 CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 CVE-2021-44832 更多信息请参见 Log4J 安全漏洞及升级。 解决方案请参见 Dockerfile 构建并推送修补后的 Docker 镜像 使用示例： root@kitploit: build and tag image docker build --build-arg=ORIGINALIMAGE=apachepulsar/pulsar-all:2.8.1 . -t...

CVE-2026-86437 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-77698

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

EUVD-2026-72325

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

CVE-2026-77698

ManageEngine Endpoint Central by Zohocorp, in versions prior to 11.5.2605.01 , is affected by a local privilege escalation vulnerability triggered through the Agent upgrade process. An attacker with low local privileges and user interaction can escalate their access, resulting in low impact to co...

CVE-2026-77698 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10546 info: name:...

Jira <8.4.0 - Server-Side Request Forgery

Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized...

playSMS <1.4.3 - Remote Code Execution

PlaySMS before version 1.4.3 is susceptible to remote code execution because it double processes a server-side template. id: CVE-2020-8644 info: name: playSMS 1.4.3 - Remote Code Execution author: dbrwsky severity: critical description: PlaySMS before version 1.4.3 is susceptible to remote code...

Ulterius Server < 1.9.5.0 - Directory Traversal

Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs. id: CVE-2017-16806 info: name: Ulterius Server 1.9.5.0 - Directory Traversal author: geeknik severity: high description: Ulterius Server before 1.9.5.0 allow...

PT-2026-86664

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

Adobe ColdFusion - Pre-Auth Remote Code Execution

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-29300 info:...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45195 info: name: Apache OFBiz -...

Apache OFBiz - Improper Authorization & Remote Code Execution

Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...