Goby(Metasec)

Goby is a powerful security tool that includes a vulnerability scanner and asset mapping functionality. visit

[Goby(Metasec) @GobySec]

⚠️CVE-2026-23760:SmarterMail enables remote attackers to reset the admin password via crafted HTTP requests, then exploit the "Volume Mounts" feature for SYSTEM privilege escalation and RCE. Goby includes a one-click exploit.
link:https://t.co/6h35NysxDN

[Jamie Levy🦉 @gleeda]

DE&TH to Vulnerabilities: Huntress Catches SmarterMail Account Takeover Leading to RCE:

Huntress has observed in-the-wild exploitation of a privileged account takeover vulnerability (CVE-2026-23760) in SmarterTool’s SmarterMail application that has resulted in successful remote code execution.

awesome blog by @CyberRaiju and Lindon Wass

https://t.co/FyYGBMSgtb

[Goby(Metasec) @GobySec]

⚠️CVE-2026-24061 (CVSS 9.8): GNU telnetd fails to sanitize the client-supplied username from the USER environment variable before passing it to the /usr/bin/login command line. Goby includes a one-click exploit.
链接: https://t.co/6h35NysxDN

[Phith0n @phithon_xg]

GNU InetUtils telnetd Argument Injection Authentication Bypass Leads to RCE (CVE-2026-24061)
USER="-f root" telnet -a 127.0.0.1 2323
Try reproduce this issue using #Vulhub
https://t.co/AyvpGABpt7

[Goby(Metasec) @GobySec]

🚨CVE-2026-23478:Affecting versions 3.1.6 through 6.0.7. An attacker can take over any account by invoking session.update() with the target's email address. A working Goby EXP has been released.
Link: https://t.co/6h35NysxDN

[Mr.Rabbit @01ra66it]

https://t.co/5IdR7D7BKNにCVSS 10.0の致命的脆弱性（CVE-2026-23478）。単一API呼び出しでアカウント完全乗っ取り、2FAも無効化。UIよりAPIが本丸。即時パッチ必須。#CVE #APIsecurity #2FA https://t.co/uOPG9jGwKc

[Mr.Rabbit @01ra66it]

https://t.co/5IdR7D7BKNにCVSS 10.0の致命的脆弱性（CVE-2026-23478）。単一API呼び出しでアカウント完全乗っ取り、2FAも無効化。UIよりAPIが本丸。即時パッチ必須。#CVE #APIsecurity #2FA https://t.co/uOPG9jGwKc

[Goby(Metasec) @GobySec]

🚨CVE-2025-68645: Zimbra Collaboration 10.0/10.1 Webmail Classic UI has an LFI vulnerability. Unauthenticated attackers can send malicious requests to /h/rest to read arbitrary files under WebRoot. Goby completed PoC reproduction.
Link: https://t.co/6h35NysxDN

[Daily CyberSecurity @the_yellow_fall]

Zimbra patches a high-severity LFI (CVE-2025-68645) allowing unauthenticated file access and a Flickr Zimlet credential leak. Upgrade to v10.1.13!

#Zimbra #ZCS #CyberSecurity #LFI #Infosec #Vulnerability #PatchNow #CVE202568645
https://t.co/uMlKDhk5iS

[Goby(Metasec) @GobySec]

🚨CCVE-2025-14847: Critical Unauthenticated MongoDB Vulnerability Exposes Sensitive Information, With Over 1.3 Million Publicly Exposed Assets — Goby Now Supports Fingerprint Detection and Vulnerability Validation.
link：https://t.co/6h35NysxDN

[FOFA @fofabot]

⚠️⚠️ CVE-2025-14847: Critical Unauthenticated MongoDB Flaw Leaks Sensitive
🔥PoC: https://t.co/5rF9Ana5g7
🔗FOFA Link: https://t.co/Shk3u7aGXk
🎯1.2m+ Results are found on the https://t.co/uLIbgJcaq5 nearly year.
FOFA Query: app="MongoDB"
#OSINT #FOFA #CyberSecurity #vulnerability

[Goby(Metasec) @GobySec]

🚨CVE-2025-55182：It has been confirmed that Dify is among the most severely affected, with an estimated vulnerability rate of over 30%. Goby now supports echo EXP detection for this vulnerability.
link：https://t.co/6h35NysxDN

[FOFA @fofabot]

⚠️⚠��� CVE-2025-55182(CVSS 10.0) && CVE-2025-66478(CVSS 10.0) : Catastrophic React Flaw allows Unauthenticated RCE on Next.js and React Server Components.
🔥PoC: https://t.co/1oOFVIDpwm
https://t.co/K3a7GithKK
🔗FOFA Link: https://t.co/2rQ046G83W
🎯8.7M Results are found on the https://t.co/uLIbgJcaq5 nearly year.
FOFA Query: app="NEXT.JS" || app="React.js"
🔖Refer: https://t.co/8wbotHasHG
#OSINT #FOFA #CyberSecurity #Vulnerability

[Goby(Metasec) @GobySec]

Tired of manually setting up an FTP server? Goby’s EXP (Exploit) capabilities have been upgraded! Starting from the practical combat of CVE-2024-56145, nail the service-dependent vulnerability and achieve getshell in one step👋
https://t.co/tDWvGy2uZ9

[Goby(Metasec) @GobySec]

🚨CVE-2025-61757:ACritical vulnerability in Oracle Identity Manager allows unauthenticated RCE. Oracle patched it 30 days ago; in-the-wild exploitation detected. Fix promptly—Goby offers one-click practical verification & exploitation.
https://t.co/6h35NysxDN

[Clandestine @akaclandestine]

GitHub - Jinxia62/Oracle-Identity-Manager-CVE-2025-61757: Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757 https://t.co/XbgCrYlkxX

[Goby(Metasec) @GobySec]

Focus on CVE-2025-61882's practical pain points! Goby EXP adds custom paths + independent service instances to easily crack path strict verification vulnerabilities, maximizing penetration efficiency～ Click the link for full technical details👇
https://t.co/upCTDhkTTb

[Goby(Metasec) @GobySec]

🚨CVE-2025-64446: Attackers can bypass authentication by traversing paths, creating administrator accounts to bypass control systems. Goby now supports one-click deployment of exploits. link:📷https://t.co/6h35NysxDN

[Dark Web Informer @DarkWebInformer]

🚨CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability has been added to the CISA KEV Catalog.

https://t.co/9idGUAIgzL

PoC: https://t.co/Vf40wNpOqV

PoC: https://t.co/0m99IEChay

[Goby(Metasec) @GobySec]

🚨CVE-2025-41243: CVE-2025-41243: An attacker can modify configuration properties by accessing the @systemProperties bean registered in the system. Successfully bypassing this restriction allows the attacker to access sensitive information.
Goby supports one-click exploitation.

[Sami Laiho @samilaiho]

PoC Released for CVE-2025-41243 - A Spring Cloud Gateway Flaw with CVSS 10.0 https://t.co/cCRmtiouwj

[Goby(Metasec) @GobySec]

🚨CVE-2025-49493 : a critical XXE in Akamai CloudTest, affecting multiple legacy SOAP endpoints. Full file read via XML payloads.
Goby already supports one-click vulnerability exploitation.👇
link:🔗https://t.co/6h35NysxDN

[XBOW @Xbow]

Even mature products hide critical flaws – and @XBOW just found another one.

CVE-2025-49493: XXE in Akamai CloudTest discovered during our climb to #1 on HackerOne.

A complete technical breakdown from an error-based detection to a full exfiltration by @djurado9

https://t.co/3CTRZ3wB5f

[Goby(Metasec) @GobySec]

🚨CVE-2025-32432 : Commvault File Upload Vulnerability. Goby has completed command execution and rebound shell reproduction.
Use the effect as shown in the demonstration.👇
🔗Download Link: https://t.co/6h35NysxDN

[The Hacker News @TheHackersNews]

🔥 Critical Exploit Alert!

A 9.0 CVSS flaw in Commvault Command Center lets hackers run code without logging in.

🎯 Targets versions 11.38.0–11.38.19
💥 Pre-auth SSRF → Remote Code Execution

Learn more about CVE-2025-34028 here: https://t.co/Scx7xa4a96

[Goby(Metasec) @GobySec]

🚨CVE-2025-32432 : Craft CMS /index.php Code Execution Vulnerability. Goby has completed the command execution EXP reproduction, demonstrating the effect:verification exploits .👇
Download Link:🔗https://t.co/6h35NyrZOf

[ʞʞıdɐɔoɥƆ @Chocapikk_]

I'm back! 🤘 Just reproduced CVE-2025-32432 and submitted a Metasploit module for it. This one targets Craft CMS RCE in versions 3.x, 4.x, and 5.x < 5.6.17. Check out the PR! 🚀

🔗 https://t.co/nXm7b02p2k

[Goby(Metasec) @GobySec]

🚨CVE-2025-32433 LErlang/OTP SSH Server Code Execution Vulnerability.When the SSH daemon runs with root privileges, attackers can gain full control of the device. This vulnerability affects all SSH servers based on the Erlang/OTP SSH library.
Goby Realize the Exploits of RCE：

[The Hacker News @TheHackersNews]

Cisco confirms: ConfD, NSO, Smart PHY & more hit by CVE-2025-32433. No RCE risk yet, but PoC exploit is out.

Erlang-based systems across network & industrial gear now under the spotlight.

Details: https://t.co/3dbVIeCtwb

[Goby(Metasec) @GobySec]

🚨CVE-2025-3248 Langflow /api/v1/validate/code Code Execution Vulnerability.
Security vulnerabilities in large AI models：Goby already supports one-click verification exploits
👉https://t.co/6h35NysxDN：

[kking @_r00tuser]

#CVE-2025-3248 #DeepSeek
在复现LangFlow 的代码执行漏洞，直接把出现漏洞的代码丢给DeepSeek，它成功构造出了漏洞利用代码，甚至还能帮你构造一个回显的POC。👍👍
https://t.co/IAz2Zo8bVu

[Goby(Metasec) @GobySec]

🚨CVE-2025-24813 ：Flaw in Apache Tomcat Exposes Servers to RCE, Data Leaks.
Gogby has been reproduced with one-click exploitatioink: Goby download link>https://t.co/6h35NysxDN

[FOFA @fofabot]

⚠️⚠️ CVE-2025-24813 Flaw in Apache Tomcat Exposes Servers to RCE, Data Leaks: Update Immediately

🎯6.5M+ Results are found on the https://t.co/uLIbgJcaq5 nearly year.

🔗FOFA Link: https://t.co/oBNfnCDUeL

FOFA Query:app="APACHE-Tomcat"

🔖Refer:https://t.co/kvx78Ricrq

#OSINT #FOFA #CyberSecurity #Vulnerability

[Goby(Metasec) @GobySec]

🚨 Ollama /api/tags Unauthorized Access Vulnerability POC/EXP:Goby has been reproduced with one-click exploitatioin>https://t.co/6h35NysxDN

[Hackread.com @HackRead]

New: Exposed #Ollama APIs, impacting AI model owners & cloud costs. Over 7,000 IPs are affected, with #DeepSeek models widely used. The highest concentrations? China, the US & Germany.

Read: https://t.co/o43F2CQhLA

#CyberSecurity #AI #Vulnerability

[Goby(Metasec) @GobySec]

🚨CVE-2024-9047 WordPress File Upload Pluginwfu_file_downloader.php Arbitrary File Read Vulnerability
Goby AI 2.0 can generate PoC/EXP code intelligently based on vulnerability details. For more information：
👉https://t.co/Z6gbFrwUai
👉Goby download link>https://t.co/6h35NysxDN