32 matches found
Vuln_Exploitation_MegaQuagga_Pentest
취약점 악용 — MegaQuagga 침투 테스트 보고서 분석가: Samuel Weiss 조직: 0x2A Security 날짜: 2026년 4월 20일 고객: MegaQuagga Publishing 대상: www.megaquagga.local 분류: 기밀 개요 이 프로젝트는 MegaQuagga Publishing 웹 환경을 대상으로 수행된 구조화된 침투 테스트 를 문서화합니다. 이번 침투 테스트에서 5개의 악용 가능한 취약점이 확인되었으며, 그중 2개는 체이닝되어 인증 없는 원격 코드 실행RCE을 달성하고 대상 호스트에 지속적인...
CVE-2019-1003000_RCE-DETECTION
CVE-2019-1003000RCE-탐지 일반 요약 취약점 CVE-2018-1000861과 CVE-2019-1003000을 연쇄하여 Jenkins CI에서 Pre-Auth RCE를 테스트하는 모듈을 만들었습니다. 처음에는 사용자 이름과 비밀번호, 작업 이름으로 취약점을 탐지하려 했지만, 두 취약점을 연쇄하는 것이 더 현실적이고 흥미로울 것이라고 생각했습니다. 사전 요구 사항 Windows, Linux 또는 macOS 머신에 Visual Studio 또는 .NET Core 프레임워크가 설치되어 있어야 합니다. 환경 설정 내가 한...
CVE-2024-4157-SSRF-RCE-Reverse-Shell
CVE-2024-4157: Havoc C2에서 리버스 셸 얻기 - SSRF와 RCE 연쇄 로컬 IP와 포트로 리버스 셸을 얻으며, CVE-2024-4157 POC와 havocauthrce를 연쇄합니다. 사용법 기본 정보 root@kitploit: $ python3 exploit.py usage: exploit.py -h -t TARGET -i IP -p PORT -A USERAGENT -H HOSTNAME -u USERNAME -d DOMAINNAME -n PROCESSNAME -ip INTERNALIP -U...
Havoc-C2-SSRF-to-RCE
Havoc-C2-SSRF-to-RCE これは、@chebuya による CVE-2024-41570 SSRF PoC を、@hyperreality による認証付きRCEエクスプロイトと連結した修正版です。このエクスプロイトは、Havoc C2 Framework. の複数の脆弱性により、対象に対してリモートでコードを実行します。 https://github.com/user-attachments/assets/b75c5934-0326-4994-a695-c18bf95a1e25 root@kitploit: usage: CVE-2024-41570.py -h -t...
vuln-chain-3-4-14-demo
vuln-chain-spring-boot — a Trivy "green but owned" demo An in...
PYSEC-2026-1348 Fides' Admin UI User Password Change Does Not Invalidate Current Session
Summary Admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS can maintain access even after password reset. This issue is not directly...
EUVD-2026-34899
A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the...
Hunting-Bugs
2026 Practical Bug Bounty Guide Built on real-world experie...
CVE-2026-40552
CVE-2026-40552 affects mpGabinet ≤ 23.12.19 and describes a Remote Command Execution via processing an attachment. An authorized user with DB access can cause system command execution by uploading an attachment and modifying its storage path to reference an attacker-controlled remote resource, or...
EUVD-2024-0892
Malicious code in bioql PyPI...
CVE-2025-57766
CVE-2025-57766 affects the Fides open-source privacy engineering platform. Prior to version 2.69.1, when an admin UI password is changed, existing active sessions are not invalidated, allowing an attacker who has obtained a valid session token (for example via XSS or other vector) to maintain acc...
CVE-2023-3545
Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS = v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of .htaccess file. This vulnerability may be exploited ...
CVE-2020-6844
In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts...
CVE-2020-4005
VMware ESXi 7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate thei...
VulnCheck KEV: CVE-2024-29988
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web MotW feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file...
CVE-2024-28850 WP Crontrol possible RCE when combined with a pre-condition
WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron system that store and execute PHP code subject to the restrictive security permissions documented here. While there is no known vulnerability...
CVE-2024-28850
WP Crontrol for WordPress can enable remote code execution if an attacker chains it with another vulnerability (e.g., a writeable SQLi or arbitrary wp_options updates) that grants control over PHP cron event parameters. The issue is not in the feature itself, but in how a pre-condition could allo...
CVE-2024-29019 ESPHome vulnerable to Authentication bypass via Cross site request forgery
ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 command line installation are vulnerable to Cross-Site Request Forgery CSRF allowing remote attackers to carry out attacks against a logged...
Unsecured endpoints in the jupyter-lsp server extension
Impact Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root...