138165 matches found
GHSA-vwf4-m7j8-wcjf
GHSA-vwf4-m7j8-wcjf — Metabase Pre-Auth SQL Injection Unaut...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-16949
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
PHP Utility Belt - ajax.php RCE
Exploits PHP Utility Belt by evaluating PHP via ajax.php code= parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php RCE — opens execute session.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient...
NUUO Camera - Unauthenticated OS Command Injection (CVE-2025-1338)
NUUO camera firmware up to 20250203 is vulnerable to unauthenticated OS command injection via the log parameter of /handleconfig.php. Command output is returned in the HTTP response. Opens an execute session for interactive command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO came...
WordPress is-human - passthru RCE (CVE-2011-10033)
Exploits CVE-2011-10033 by injecting PHP into the type parameter of is-human/engine.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress is-human plugin RCE CVE-2011-10033.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handl...
AWStats Totals - sort Parameter RCE (CVE-2008-3922)
Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
ApPHP MicroBlog - index.php RCE Detection
Detects ApPHP MicroBlog RCE via index.php?b;phpinfo;echo...=/ style parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- """ApPHP MicroBlog index.php parameter RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...
Adobe ColdFusion - locale File Read (CVE-2010-2861)
Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages.""" from kittysploit import from lib.protocols.http.httpclient import...
Pulse CMS - p Parameter LFI Detection (CVE-2010-4330)
Detects CVE-2010-4330 via index.php??p=../../../../etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4330 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pulse CMS - p...
AWStats Totals - sort Parameter RCE Detection (CVE-2008-3922)
Detects CVE-2008-3922 by requesting awstatstotals.php?sort=.phpinfo.exit.$a and matching phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2008-3922 by requesting awstatstotals.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
hybris Commerce - medias context LFI Detection (CVE-2014-8871)
Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...
Phpunity Newsmanager - tell.php LFI Detection (CVE-2010-0799)
Detects CVE-2010-0799 via misc/tellafriend/tell.php?id=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-0799 via misc/tellafriend/tell.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...
Honeywell IP Camera - check.cgi LFI Detection
Detects Honeywell camera LFI via /check.cgi?file=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP camera check.cgi LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Honeywel...
CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
EUVD-2026-54999
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075
The All-in-One Video Gallery WordPress plugin (versions < 4.9.2 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin registers a public, unauthenticated file-download handler via the ?vdl= parameter on aiovg_videos posts. Specifically, the AIOVG_Public_Vid...
CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19053 ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection...
CVE-2026-19384
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...