CVE-2025-28009

CVE-2025-28009 - SQL Injection in Dietiqa App v1.0.20 Discovered by: Saharuddin Azman Vendor: Appventure Sdn Bhd Product: Dietiqa App Version Affected: v1.0.20 CVE ID: CVE-2025-28009 Vulnerability Type: SQL Injection 📝 Description A SQL Injection vulnerability exists in the u parameter of the...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2021-33831

Introduction The application is used for tracking people according to German infection laws to be able to trace Covid-19 infection chains. It was created by a student project called iCampus and is used not only at the university in Wildau but also at Cottbus-Senftenberg. Around 10.000 people are...

CVE-2023-1665

CVE-2023-1665 Brute Force on Twake App Open Source Version of Microsoft Teams v2023.Q1.1223 CVSS: 7.8 Collaboration App, Twake https://twake.app before versions v2023.Q1.1223 does not restrict unauthenticated login attempts allowing for brute force attacks at the login page. At the time of this...

CVE_6387

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. T...

CVE-2024-50477

CVE-2024-50477 Stacks Mobile App Builder = 5.2.3 - Authentication Bypass via Account Takeover Description: The Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

EUVD-2026-87713

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

cve-2015-3839_PoC

cve-2015-3839PoC PoC of cve-2015-3839 which my cause SMS app of Android Crash DoS It worked well on my test devices Nexus 5Android 4.4.4 and Nexus 5Android 5.0.1...

tgscope

tgscope Telegram OSINT, scraping and archival. A local web app that runs entirely on your machine and talks only to Telegram. root@kitploit: npm install npm start Then open http://127.0.0.1:5173. The first run walks you through API credentials, a QR sign-in and loading your dialogs. Telegram is t...

CVE-2021-521-Exploit

CVE-2021-521-Exploit Exploit de laboratorio CVE-2021-521: la app usa reflexión de Java para acceder a componentes del sistema Android, obteniendo una lista de todas las apps instaladas. La reflexión accede a ApplicationPackageManager y PackageManagerService, explotando la vulnerabilidad...

filekey

🔐 FileKey FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no cloud. 🛡️ FileKey is free, open source, and privacy-first. Live at filekey.app. 🚀 Features ✅ Free & Open Source – Licensed under GPLv3. ✅ Accountless – No logins, no...

Bad secure rails app

This repository does not have a README...

CVE-2024-34463

CVE-2024-34463 Affected Devices : BPL Smart Weighing Scale PWS-01-BT https://www.bplmedicaltechnologies.com/product-details/weighing-scales/personal-weighing-scale-pws-01bt/ Vulnerability : Insufficient security in the Bluetooth communication between the digital weighing scale and the associated...

CVE-2025-55182

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. T...