68456 matches found
CVE-2022-31813
Avvia il campo di tiro docker compose up --build Accesso normale root@kitploit: GET / HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/145.0.0.0 Safari/537.36 Accept:...
EUVD-2026-67801
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...
CVE-2026-82270
Portkey AI Gateway through version 1.15.2 contains a Server-Side Request Forgery (SSRF) vulnerability in the /v1/proxy/* route. The root cause is the absence of the requestValidator middleware on that endpoint. An unauthenticated attacker can set the x-portkey-custom-host header to an internal ad...
CVE-2026-3854-PoC
CVE-2026-3854 PoC — GitHub RCE durch X-Stat Push-Option-Injektion Nur für Bildungszwecke und autorisierte Sicherheitsforschung. Verwenden Sie es nicht gegen ein System ohne ausdrückliche schriftliche Genehmigung. Übersicht CVE-2026-3854 ist eine Schwachstelle zur Remote-Code-Ausführung in der...
XWFAcropalypse
Acropalypse CVE-2023-21036 è una vulnerabilità di sicurezza nello strumento Google Pixel Markup e in Windows Snip & Sketch che consente il recupero dei dati ritagliati o rimossi dagli screenshot PNG. Scoperta nel 2023, consente agli attaccanti di ricostruire le immagini originali, esponendo...
cve-2025-29927
CVE-2025-29927 1. aceder a /api/flag 2. adicionar x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware como cabeçalho 3. ver a resposta...
CVE-2026-38526-KrayinCRM-RCE
CVE-2026-38526 - RCE su Krayin CRM xpl0ited by infrar3d Questo è un proof-of-concept di Remote Code Execution RCE specificamente progettato per Krayin CRM v2.2.x, un sistema di gestione delle relazioni con i clienti open-source. Lo script automatizza lo sfruttamento di una vulnerabilità di upload...
xz
xz — distribuição binária portátil Empacotado xz-utils @ 5.8.3 pós-CVE-2024-3094 — distribuição binária portátil para o ecossistema de pacotes x-cmd. Instalação root@kitploit: macOS / Linux anywhere with x: x eget x-cmd-build/xz --to /usr/local/bin/xz Manual: 1. Go to...
CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...
CVE-2026-56854
CVE-2026-56854 affects golang.org/x/crypto/ssh . The source-address critical option in Permissions returned by authentication callbacks was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths (extending a prior fix for CVE-2026-46595). Callbacks for PasswordCallback , Keyb...
CVE-2025-66204
CVE-2025-66204: WBCE CMS consente di bypassare la protezione brute-force utilizzando l'header X-Forwarded-For Panoramica...
GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...
phishlulz
PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...
Log4Shell-PoC-Application
☕ Applicazione PoC Log4Shell Applicazione web basata sul framework Spring per la proof of concept delle vulnerabilità log4shell Installazione e Avvio !Important Per avviare questo progetto è richiesto JDK 1.8 8u131 in sviluppo Utilizza il Dockerfile fornito per compilare ed eseguire l'immagine...
Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287
Dieses Repository hat keine README-Datei...
Drupalgeddon-Python3
Drupalgeddon Python3 Ausgabe Ein neu geschriebener POC zur CVE-2014-3704, erstellt im Rahmen meiner CPTS-Ausbildung auf HackTheBox. https://nvd.nist.gov/vuln/detail/CVE-2014-3704 CVE-2014-3704, bekannt als Drupalgeddon, betrifft die Versionen 7.0 bis 7.31 und wurde in Version 7.32 behoben. Es...
CVE-2020-35590
Informazioni sull'Exploit Titolo Exploit: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Data: 2020-06-09 Autore Exploit: N4nj0 Link Software: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Versione: 2.13.0 Testato su: WordPress 5.4.1,...
CVE-2022-24112
CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml L'essenza di questa vulnerabilità è simile a CVE-2021-45232: entrambe aggirano l'autorizzazione o sfruttano l'assenza di autorizzazione per eseguire comandi tramite filterfunc o script in u...
CVE-2021-43798
CVE-2021-43798: Vulnerabilità di lettura arbitraria di file in Grafana Aggiunto template nuclei per il riconoscimento di tutte le versioni Windows+Linux Elenco di 52 plugin: root@kitploit: live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canv...