Lucene search
+L

314 matches found

Kitploit
Kitploit
โ€ขadded 2026/09/14 6:19 p.m.โ€ข7 views

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 ่‘—่€…: Subhodeep Baroi CVE-2024-40119: Nepstech Wifi Router NTPL-XPON1GFEVN v1.0ใซใŠใ‘ใ‚‹CSRF่„†ๅผฑๆ€ง ่ชฌๆ˜Ž CVE-2024-40119 ใฏใ€Nepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 ใƒ•ใ‚กใƒผใƒ ใ‚ฆใ‚งใ‚ข...

8.8CVSS6.1AI score0.00495EPSS
SaveExploits0
Kitploit
Kitploit
โ€ขadded 2026/09/14 3:57 a.m.โ€ข7 views

CVE-2025-14340

XSSใซใ‚ˆใ‚‹็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆไน—ใฃๅ–ใ‚Š CVE-2025-14340 Payaraใฎ็ฎก็†RESTใ‚คใƒณใ‚ฟใƒผใƒ•ใ‚งใƒผใ‚นใซใŠใ‘ใ‚‹ใ‚ฏใƒญใ‚นใ‚ตใ‚คใƒˆใ‚นใ‚ฏใƒชใƒ—ใƒ†ใ‚ฃใƒณใ‚ฐใฎ่„†ๅผฑๆ€งใซใ‚ˆใ‚Šใ€ๆ”ปๆ’ƒ่€…ใŒๅˆถๅพกใ™ใ‚‹JavaScriptใŒๅฎŸ่กŒใ•ใ‚Œใ€็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆใฎไน—ใฃๅ–ใ‚ŠใซใคใชใŒใ‚Šใพใ™ใ€‚็†็”ฑใฏไปฅไธ‹ใฎ้€šใ‚Šใงใ™๏ผš 1. ใƒ‘ใƒใƒซใฏHTTP Basic่ช่จผใ‚’ไฝฟ็”จใ—ใฆใ„ใพใ™๏ผˆใƒ–ใƒฉใ‚ฆใ‚ถใŒๅŒไธ€ใ‚ชใƒชใ‚ธใƒณใƒชใ‚ฏใ‚จใ‚นใƒˆใซๅฏพใ—ใฆ่‡ชๅ‹•็š„ใซ่ช่จผๆƒ…ๅ ฑใ‚’้€ไฟกใ—ใพใ™๏ผ‰ใ€‚ 2. change-admin-passwordใ‚จใƒณใƒ‰ใƒใ‚คใƒณใƒˆใฏใ€ใƒฆใƒผใ‚ถใƒผใฎใƒ‘ใ‚นใƒฏใƒผใƒ‰ใ‚’ๆ›ดๆ–ฐใ™ใ‚‹้š›ใซ็พๅœจใฎใƒ‘ใ‚นใƒฏใƒผใƒ‰ใ‚’ๅฟ…่ฆใจใ—ใพใ›ใ‚“ใ€‚ 3...

9.3CVSS5.9AI score0.01002EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/13 12:54 p.m.โ€ข7 views

CVE-2023-32707

CVE-2023-32707 exploitdb ใงๅ ฑๅ‘Šใ•ใ‚ŒใŸCVEใซๅŸบใฅใๆ”น่‰ฏใ•ใ‚ŒใŸPOCใ‚จใ‚ฏใ‚นใƒ—ใƒญใ‚คใƒˆ Exploit Title: Splunk 9.0.5 - ็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆใฎไน—ใฃๅ–ใ‚Š CVE: CVE-2023-32707 ๆฆ‚่ฆ ใ“ใฎใ‚นใ‚ฏใƒชใƒ—ใƒˆใฏSplunk 9.0.5ใฎ่„†ๅผฑๆ€งใ‚’ๆ‚ช็”จใ—ใ€็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆใฎไน—ใฃๅ–ใ‚Šใ‚’ๅฏ่ƒฝใซใ—ใพใ™ใ€‚ใ“ใฎใ‚จใ‚ฏใ‚นใƒ—ใƒญใ‚คใƒˆใฏใ€edituser ๆฉŸ่ƒฝใ‚’ๆŒใคไฝŽๆจฉ้™ใƒฆใƒผใ‚ถใƒผใ‚’ๅˆฉ็”จใ—ใฆๆจฉ้™ใ‚’ๆ˜‡ๆ ผใ•ใ›ใพใ™ใ€‚ ๅ‰ๆๆกไปถ Python 3.x ๅฟ…่ฆใชPythonใƒ‘ใƒƒใ‚ฑใƒผใ‚ธ๏ผˆpip3 install -r requirements.txt ใงใ‚คใƒณใ‚นใƒˆใƒผใƒซ๏ผ‰:...

8.8CVSS7.9AI score0.79019EPSS
SaveExploits7
Kitploit
Kitploit
โ€ขadded 2026/09/12 5:26 p.m.โ€ข7 views

CVE-2025-50363_BXSS_CVE

ใƒ—ใƒญใ‚ธใ‚งใ‚ฏใƒˆๅ & ใƒชใƒใ‚ธใƒˆใƒชURL: Maid Hiring Management System using PHP and MySQL๏ผˆPHPใจMySQLใ‚’ไฝฟ็”จใ—ใŸใƒกใ‚คใƒ‰้›‡็”จ็ฎก็†ใ‚ทใ‚นใƒ†ใƒ ๏ผ‰ ่„†ๅผฑๆ€งใ‚ฟใ‚คใƒ—: ใƒ–ใƒฉใ‚คใƒณใƒ‰XSSใซใ‚ˆใ‚‹ๆจฉ้™ๆ˜‡ๆ ผ ๅฝฑ้Ÿฟใ‚’ๅ—ใ‘ใ‚‹ใƒใƒผใ‚ธใƒงใƒณ:v1.0 ๐Ÿ’ฃ่„†ๅผฑๆ€งใฎ่ชฌๆ˜Ž: Maid Hiring Management System ใซใŠใ„ใฆใ€ใƒ–ใƒฉใ‚คใƒณใƒ‰XSSใฎ่„†ๅผฑๆ€งใŒ็™บ่ฆ‹ใ•ใ‚Œใพใ—ใŸใ€‚ใ“ใ‚Œใซใ‚ˆใ‚Šใ€ไธ€่ˆฌใƒฆใƒผใ‚ถใƒผ๏ผˆใƒกใ‚คใƒ‰ใ‚„้›‡็”จ่€…ใชใฉ๏ผ‰ใŒๆจฉ้™ใ‚’ๆ˜‡ๆ ผใ•ใ›ใ€็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆใ‚’ไน—ใฃๅ–ใ‚‹ๅฏ่ƒฝๆ€งใŒใ‚ใ‚Šใพใ™ใ€‚ ๐Ÿ‘ฉโ€๐Ÿ’ปๅฝฑ้Ÿฟ:...

5.4CVSS5.7AI score0.00234EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/12 2:05 p.m.โ€ข8 views

CVE-2021-40101

ใ‚ขใƒณใ‚ฑใƒผใƒˆXSSใจCSRFใฎ็ต„ใฟๅˆใ‚ใ›ใซใ‚ˆใ‚Šใ€Concrete5 8.5.4ใง็ฎก็†่€…ใ‚ขใ‚ซใ‚ฆใƒณใƒˆใŒไน—ใฃๅ–ใ‚‰ใ‚Œใ‚‹ 9ใ‚ˆใ‚Šๅ‰ใฎใƒใƒผใ‚ธใƒงใƒณใฎConcrete CMS็ฎก็†่€…ใฏใ€ๅˆฅใฎใƒฆใƒผใ‚ถใƒผใฎใƒ‘ใ‚นใƒฏใƒผใƒ‰ใ‚’ๅค‰ๆ›ดใ™ใ‚‹้š›ใซ่‡ชๅˆ†ใฎใƒ‘ใ‚นใƒฏใƒผใƒ‰ใ‚’ๅ…ฅๅŠ›ใ™ใ‚‹ๅฟ…่ฆใŒใ‚ใ‚Šใพใ›ใ‚“ใงใ—ใŸใ€‚ CVE-2021-28145๏ผˆใ€ŒConcrete...

7.2CVSS6.7AI score0.02555EPSS
SaveExploits0References1
Kitploit
Kitploit
โ€ขadded 2026/09/10 12:55 a.m.โ€ข8 views

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress ๆ’ไปถ ๆœช่ฎค่ฏ็ฎก็†ๅ‘˜่ฎฟ้—ฎ ๆฆ‚ๅฟต้ชŒ่ฏ๏ผˆPoC๏ผ‰ ๏ผŒๆผ”็คบ CVE-2026-23550 - Modular DS WordPress ๆ’ไปถ ๏ผˆ็‰ˆๆœฌ โ‰ค2.5.1๏ผ‰ไธญ็š„ไธฅ้‡ๆœช่ฎค่ฏ็ฎก็†ๅ‘˜่ดฆๆˆทๆŽฅ็ฎกๆผๆดžใ€‚ๅทฒๅœจ้‡Žๅค–่ขซ็งฏๆžๅˆฉ็”จใ€‚ ๆ”ปๅ‡ปๆ‘˜่ฆ ๏ผš/api/modular-connector/login ไธญ็ผบ้™ท็š„ REST API ่ทฏ็”ฑๅœจ origin=mo ๆ—ถ็ป•่ฟ‡ WordPress ่ฎค่ฏ๏ผŒๆŽˆไบˆๆœช่ฎค่ฏ็ฎก็†ๅ‘˜ไผš่ฏ Cookieใ€‚ ๐Ÿš€ ๅฟซ้€Ÿๆผ”็คบ - ๅฆ‚ๆžœๆ‚จๅทฒ้…็ฝฎๅฅฝ WP root@kitploit:...

9.8CVSS6.2AI score0.21687EPSS
SaveExploits9
Cvelist
Cvelist
โ€ขadded 2026/09/09 6:44 p.m.โ€ข33 views

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS0.00282EPSS
SaveExploits0References1
Kitploit
Kitploit
โ€ขadded 2026/09/08 6:39 p.m.โ€ข9 views

CVE-2026-8181

CVE-2026-8181 Burst Statistics | ๆƒ้™็ป•่ฟ‡่‡ณ็ฎก็†ๅ‘˜่ดฆๆˆทๆŽฅ็ฎก ๆ่ฟฐ๏ผš Burst Statistics 3.4.0 - 3.4.1.1 - ๆƒ้™็ป•่ฟ‡่‡ณ็ฎก็†ๅ‘˜่ดฆๆˆทๆŽฅ็ฎก WordPress ๆ’ไปถ Burst Statistics โ€“ ้š็งๅ‹ๅฅฝๅž‹ WordPress ๅˆ†ๆž๏ผˆGoogle Analytics ๆ›ฟไปฃๅ“๏ผ‰ๅœจ 3.4.0 ๅˆฐ 3.4.1.1 ็‰ˆๆœฌไธญๅญ˜ๅœจ่บซไปฝ้ชŒ่ฏ็ป•่ฟ‡ๆผๆดžใ€‚่ฟ™ๆ˜ฏ็”ฑไบŽๅœจ้ชŒ่ฏๆฅ่‡ช Authorization ๅคด็š„ๅบ”็”จ็จ‹ๅบๅฏ†็ ๆ—ถ๏ผŒismainwpauthenticated ๅ‡ฝๆ•ฐๅฏน่ฟ”ๅ›žๅ€ผ็š„ๅค„็†ไธๆญฃ็กฎใ€‚่ฏฅๅ‡ฝๆ•ฐ่ฐƒ็”จ...

9.8CVSS6AI score0.14608EPSS
SaveExploits13
Kitploit
Kitploit
โ€ขadded 2026/09/08 7:42 a.m.โ€ข5 views

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

ๅฎ‰ๅ…จๅ…ฌๅ‘Š๏ผšๆœช่ฎค่ฏ็š„ๅญ˜ๅ‚จๅž‹่ทจ็ซ™่„šๆœฌๅฏผ่‡ด็ฎก็†ๅ‘˜่ดฆๆˆท่ขซๆŽฅ็ฎก๏ผˆopenclaw-dashboard๏ผ‰ ๆ ‡้ข˜๏ผšOpenClaw Dashboard v3.0.0 ้€š่ฟ‡็™ปๅฝ•ๅคฑ่ดฅ็š„็”จๆˆทๅๅญ—ๆฎตๅฎž็Žฐๅญ˜ๅ‚จๅž‹ XSS ๅˆ†้…็š„ CVE ID๏ผšCVE-2026-66418 ็›ฎๆ ‡ไป“ๅบ“๏ผšhttps://github.com/tugcantopaloglu/openclaw-dashboard ๆ‘˜่ฆ ็™ปๅฝ•็ซฏ็‚นๅœจๆฒกๆœ‰ไปปไฝ•้ชŒ่ฏ็š„ๆƒ…ๅ†ตไธ‹๏ผŒๅฐ†ๆไบค็š„็”จๆˆทๅ่ฎฐๅฝ•ๅˆฐๅฎก่ฎกๆ—ฅๅฟ—ไธญใ€‚้€š็Ÿฅ้ขๆฟ้šๅŽไผš่ฏปๅ–่ฟ™ไบ›ๆ—ฅๅฟ—ๆก็›ฎ๏ผŒๅนถ้€š่ฟ‡ innerHTML...

9.3CVSS5.9AI score0.00511EPSS
SaveExploits2References1
Kitploit
Kitploit
โ€ขadded 2026/09/08 7:32 a.m.โ€ข6 views

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint โ€“ Calendar Booking Plugin CVE-2026-6741 โ€” LatePoint Privilege Escalation Scanner Plugin: LatePoint โ€“ Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

8.8CVSS6AI score0.00293EPSS
SaveExploits1
NVD
NVD
โ€ขadded 2026/09/01 5:17 a.m.โ€ข10 views

CVE-2026-19806

The Support Genix โ€“ Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

8.8CVSS0.00396EPSS
SaveExploits0References12
EUVD
EUVD
โ€ขadded 2026/08/26 3:39 a.m.โ€ข10 views

EUVD-2026-66230

The TranslatePress โ€“ Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

9.8CVSS5.4AI score0.02493EPSS
SaveExploits4References10
EUVD
EUVD
โ€ขadded 2026/08/24 2:51 p.m.โ€ข10 views

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS5.9AI score0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
โ€ขadded 2026/08/24 2:51 p.m.โ€ข48 views

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS0.00216EPSS
SaveExploits0References1
NVD
NVD
โ€ขadded 2026/08/21 8:16 a.m.โ€ข14 views

CVE-2026-77264

The Automation Web Platform โ€“ Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

9.8CVSS0.00568EPSS
SaveExploits0References2
CVE
CVE
โ€ขadded 2026/08/21 7:39 a.m.โ€ข72 views

CVE-2026-77264

The Automation Web Platform โ€“ Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions โ‰ค 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

9.8CVSS5.5AI score0.00568EPSS
SaveExploits0References2
Cvelist
Cvelist
โ€ขadded 2026/08/19 5:39 p.m.โ€ข40 views

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS0.00374EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
โ€ขadded 2026/08/19 5:39 p.m.โ€ข14 views

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS5.9AI score0.00374EPSS
SaveExploits0References2
EUVD
EUVD
โ€ขadded 2026/08/19 6:00 a.m.โ€ข15 views

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

8.1CVSS5.3AI score0.00248EPSS
SaveExploits0References1
OSV
OSV
โ€ขadded 2026/08/18 8:47 p.m.โ€ข13 views

GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

8.7CVSS6AI score0.00382EPSS
SaveExploits0References4
Rows per page
Query Builder