Lucene search
+L

2482 matches found

Nuclei
Nuclei
added 2026/09/14 5:13 a.m.87 views

All Thrive Themes and Plugins - Unauthenticated Option Update

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

5.3CVSS6AI score0.02059EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/14 3:36 a.m.7 views

CVE-2025-4631

🚨 CVE-2025-4631 - Exploit de Escalada de Privilegios del Plugin Profitori de WordPress 📌 Resumen de la Vulnerabilidad El Plugin Profitori versiones 2.0.6.0 a 2.1.1.3 es vulnerable a una escalada de privilegios no autenticada debido a la falta de una comprobación de capacidades en el endpoint...

9.8CVSS5.9AI score0.00733EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/14 3:19 a.m.5 views

CVE-2022-36804

CVE-2022-36804 - Vulnerabilidad de Inyección de Comandos en Atlassian Bitbucket Server y Data Center ⚠️ Solo con fines educativos y de investigación de seguridad autorizada Autores del Exploit Original Muy agradecido al autor original del PoC Walnut Security Services Pvt. Ltd Descripción Varios...

8.8CVSS8.8AI score0.99174EPSS
SaveExploits25References1
NVD
NVD
added 2026/09/13 11:16 p.m.9 views

CVE-2026-90603

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

7.5CVSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/13 11:07 p.m.4 views

CVE-2023-27163

PoC de SSRF en Request-Baskets CVE-2023-27163 Este repositorio contiene una Prueba de Concepto PoC para CVE-2023-27163, una vulnerabilidad de Server-Side Request Forgery SSRF descubierta en request-baskets hasta la versión 1.2.1. Esta vulnerabilidad permite a atacantes acceder a recursos de red e...

6.5CVSS6.8AI score0.06591EPSS
SaveExploits29References4
Kitploit
Kitploit
added 2026/09/13 11:06 p.m.6 views

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 Informe de referencia: GHSA-pgpj-v85q-h5fm Este repositorio contiene una configuración de docker compose que configura tanto un servidor pyLoad como un servidor atacante que solo proporciona un csrf.html. Para probarlo usted mismo, simplemente ejecute docker composer up necesita...

9.6CVSS7.9AI score0.00948EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 9:29 p.m.6 views

CVE-2026-57821-PoC-Exploit

🛡️ CVE-2026-57821 – Inyección SQL en Apache Fineract ⚠️ AVISO LEGAL Y ÉTICO Este toolkit se proporciona estrictamente para fines educativos, de formación y de pruebas de seguridad autorizadas. El uso no autorizado contra cualquier sistema sin permiso escrito explícito es ilegal y viola las leyes de...

8.1CVSS7.5AI score0.00743EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 8:45 p.m.7 views

flar3ad

flar3ad is a tool that takes advantage of the CVE-2026-51031 to read files from a target server taking advantage of the /v1 endpoint of FlareSolverr's API and using driver.get function in order to exploit the vulnerability. Further explained in xinyi's blog. Installation root@kitploit: git clone...

7.5CVSS5.9AI score0.00488EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 8:36 p.m.4 views

CVE-2025-3248

CVE-2025-3248 Ejecución remota de código utilizando un endpoint API vulnerable. Prueba de concepto. Información: ⚠️ ¡Úsalo bajo tu propio riesgo! ❓ Opción añadida para shell inversa. ✅ Reintento automático si validatecode está desactivado. Demostración Uso root@kitploit: python CVE-2025-3248.py /...

9.8CVSS8.5AI score0.99989EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/13 8:18 p.m.5 views

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 es una vulnerabilidad de ejecución remota de código en Metabase. Esta vulnerabilidad se debe a un defecto de seguridad en el manejo de las cadenas de conexión JDBC por parte de Metabase al procesar el punto final de API no autenticado...

9.8CVSS8.4AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/13 6:10 p.m.5 views

CVE-2023-23752

CVE-2023-23752 Exploit para CVE-2023-23752 4.0.0 GET /api/index.php/v1/config/application?public=true HTTP/1.1 Host: 10.9.49.205 User-Agent: curl/7.68.0 Accept: / Mark bundle as not supporting multiuse HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 15:14:05 GMT Server: Apache/2.4.41 Ubuntu x-frame-option...

5.3CVSS6.8AI score0.99827EPSS
SaveExploits43
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.105 views

AnythingLLM - Information Disclosure

AnythingLLM suffers from an information disclosure vulnerability through the /api/setup-complete API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM...

7.5CVSS7.2AI score0.31102EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.25 views

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

6.1CVSS6.5AI score0.02072EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/13 2:43 p.m.13 views

CVE-2022-1388_PoC

Explotación de RCE en F5 BIG-IP CVE-2022-1388 POST 1: root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " Línea de comandos curl: root@kitploit: $ curl -i...

9.8CVSS8.5AI score0.99958EPSS
SaveExploits63
Kitploit
Kitploit
added 2026/09/13 1:56 p.m.5 views

CVE-2022-40684

CVE-2022-40684 by 1vere$k For now it's a POC copy for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Coppied from https://github.com/horizon3ai/CVE-2022-40684 Analysis The exploit uses the simple payload: root@kitploit: PUT /api/v2/cmdb/system/admin/admi...

9.8CVSS8.4AI score0.99984EPSS
SaveExploits25References1
Kitploit
Kitploit
added 2026/09/13 1:50 p.m.6 views

CVE-2023-27163

CVE-2023-27163 Request-Baskets v1.2.1 - falsificación de solicitudes del lado del servidor SSRF Se descubrió que request-baskets hasta v1.2.1 contiene una vulnerabilidad de falsificación de solicitudes del lado del servidor SSRF a través del componente /api/baskets/name. Esta vulnerabilidad permi...

6.5CVSS6.8AI score0.06591EPSS
SaveExploits29
Kitploit
Kitploit
added 2026/09/13 1:07 p.m.3 views

Burp_Collector

Burp Collector Burp Collector is a multi-processing tool that is specifically designed to aid Pentesters and Bug Hunters in Web/Mobile Application testing. With its powerful capabilities, it streamlines the process of collecting and extracting information from Burp Suite files, empowering you to...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 12:25 p.m.7 views

CVE-2022-40684-POC

CVE-2022-40684-POC FortiProxy / FortiOS Bypass de autenticación Explotación masiva /api/v2/cmdb/system/admin/ "ssh-public-key1": "" root@kitploit: ffuf -c -w hosts.txt -u FUZZ/api/v2/cmdb/system/admin/admin -X PUT -H 'User-Agent: Report Runner' -H 'Content-Type: application/json' -H 'Forwarded:...

9.8CVSS8.2AI score0.99984EPSS
SaveExploits25References2
Kitploit
Kitploit
added 2026/09/13 9:05 a.m.9 views

CVE-2023-27532

CVE-2023-27532 PoC para CVE-2023-27532 que afecta a Veeam Backup and Replication Análisis técnico En nuestro blog se puede encontrar un análisis técnico de la causa raíz de la vulnerabilidad: https://www.horizon3.ai/veeam-backup-and-replication-cve-2023-27532-deep-dive Resumen Este PoC abusa de u...

7.5CVSS8.3AI score0.7761EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/13 7:32 a.m.12 views

CVE-2023-27163-POC

CVE-2023-27163 CVE-2023-27163 Request-baskets hasta v1.2.1 se descubrió que contiene una vulnerabilidad de Server-Side Request Forgery SSRF a través del componente /api/baskets/name. Esta vulnerabilidad permite a los atacantes acceder a recursos de red e información sensible a través de una...

6.5CVSS6.7AI score0.06591EPSS
SaveExploits29
Rows per page
Query Builder