django-cve-2020-13254

Django CVE-2020-13254 This repository demonstrates exploitation of CVE-2020-13254 in two ways – via a web interface and via a failing test case. For more details visit: https://danpalmer.me/2020-06-07-django-memcache-vulnerability/ Exploiting via the web The example provides a web interface with ...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example...

redteam-plan

🔥 🚒 Planning a Red Team exercise This document helps inform red team planning by contrasting against the very specific red team style described in Red Teams. This method expresses several biases to optimize for blue team value and enthusiasm. It specifically avoids attempts to motivate by red tea...

bincat

Introduction What is BinCAT? BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse engineers, directly from IDA or using Python for automation. It features: value analysis registers and memory taint analysis type reconstruction and propagation backward and forward analysis...

CVE-2022-24124

前言 Casdoor是一个基于OAuth 2.0/OIDC的中心化的单点登录（SSO）身份验证平台 编号 CVE编号:CVE-2022-24124 CNPD编号:CNPD-202201-7304 影响版本 危险等级：高 7.5 HIGH POC/EXP：已公开 Casdoor POC: /api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml1,version,3 一键验证脚本 声明: 工具仅供安全研究或授权渗透，非法用途后果自负，作者并不承担任何责任以及连带责任...

CVE-2019-19945_Test

CVE-2019-19945Test This is the code for the first Proposed CVE 1. Install Docker 2. Build & RUN Server cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Get Server Container IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershel...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the ping function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through t...

WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

frida-ios-hook

Frida iOS hook 📍 一个帮助您轻松使用Frida的工具。它支持用于跟踪类、函数以及修改iOS平台方法返回值的脚本。 👉 对应Android平台：frida-android-hook 👉 用于拦截iOS应用中加密API：frida-ios-intercept-api 环境操作系统支持 操作系统| 支持情况| 备注 ---|---|--- MacOS| ✅| 稳定 Linux| ✅| 稳定 Windows| ✅| 不稳定 兼容性 iOS| Frida| Frida-tools| 支持情况| 稳定版本 ---|---|---|---|--- 16.7.11| 16.7.14|...

CVE-2020-29667

CVE-2020-29667 Insufficient Session Expiration | Predefined Cookie Value Suggested description In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system and operate remote ATM...

CVE-2024-48762

CVE-2024-48762 Description Command injection vulnerability in /usr/www/application/models/settingscamera.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. POC root@kitploit: GET /settings/applyfirmware/;idtest123.txt;/false HTTP/1.1 Host: XXXX...

cve-2022-44268

为 HackTheBox Pilgrimage 量身定制的漏洞利用工具 使用 cve-2022-44268 的自动 python 脚本，可以从输入文件列表中添加带有文件名的 profile 值到输入文件中，利用来自 Burpsuite 的输入 request.req 文件（已包含）更新图片文件上传，上传每个修改后的图片，然后从返回的 url 下载图片并提取文件内容，将其放入指定的输出目录。 root@kitploit: $ ./cve-2022-44268.py usage: cve-2022-44268.py -h basepng filelist requestreq outputd...

CVE-2020-0796

CVE-2020-0796 Integer Overflow Vulnerability By inserting a value larger than what can be stored in the OriginalCompressedSegmentSize field, the variable cannot handle this value and unintentionally interprets it as a very small number or a negative value. This can cause unexpected behavior in th...

CVE-2022-22980

CVE-2022-22980 Spring Data MongoDB SpEL Expression Injection MongoDB is a document-oriented NoSQL database with the scalable and flexible that used for high volume data storage. Instead of using tables and rows as in the traditional relational databases, MongoDB makes use of collections and...

qsreplace

qsreplace 从标准输入接受URL，将所有查询字符串值替换为用户提供的值，每个主机和路径的每个查询字符串参数组合只输出一次。 用法 示例输入文件： root@kitploit: ▶ cat urls.txt https://example.com/path?one=1&two=2 https://example.com/path?two=2&one=1 https://example.com/pathtwo?two=2&one=1 https://example.net/a/path?two=2&one=1 替换查询字符串值 root@kitploit: ▶ cat urls.tx...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-89462

A flaw was found in the Linux kernel's power supply subsystem, specifically within the max17040 driver. This vulnerability occurs when the max17040getvcell and max17040getsoc functions fail to properly handle errors returned by regmapread during an I2C transfer. As a result, uninitialized registe...

CVE-2026-89665

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...

AZL-100521 CVE-2026-89573 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...