6066 matches found
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
EUVD-2026-94309
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-105138
The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2024-34470
CVE-2024-34470 PoC and Bulk Scanner Overview This is a proof-of-concept PoC and bulk scanner for CVE-2024-34470: Path Traversal vulnerability HSC Mailinspector affects all versions up to 5.2.18. How to Use POC in Action: Single Target Scan To scan a single target IP: python cve-2024-34470.py -u...
FinalRecon
Twitter - Telegram - thewhiteh4t's Blog FinalRecon — это универсальное средство автоматической веб-разведки , написанное на Python. Цель FinalRecon — предоставить обзор цели за короткое время, сохраняя при этом точность результатов. Вместо выполнения нескольких инструментов один за другим он...
CVE-2021-41773
CVE-2021-41773 CVE-2021-41773 POC with Docker Configuration To customize the httpd.conf file, change line 251 in the section from Require all denied to Require all granted. AllowOverride none Require all granted Create a Dockerfile in your project FROM httpd:2.4.49 COPY ./httpd.conf...
WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting
WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...
All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...
All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...
All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery SSRF via the 'dl' parameter found in the /public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the serve...
WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting
WordPress All-in-One WP Migration plugin 7.62 and prior contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials a...
Show all comments < 7.0.1 - Cross-Site Scripting
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. id: CVE-2022-4295 info: name: Show all commen...
CVE-2026-53939
A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...
git-all-secrets
git-all-secrets À propos git-all-secrets est un outil qui peut : Cloner plusieurs dépôts GitHub publics/privés d'une organisation et les scanner, Cloner plusieurs dépôts GitHub publics/privés d'un utilisateur appartenant à une organisation et les scanner, Cloner un seul dépôt public/privé d'une...
POC-AIOWPM-CVE-2026-19949
CVE-2026-19949 — Prueba de concepto documentada y reproducible en Docker Inyección SQL de segundo orden no autenticada en All-in-One WP Migration and Backup WordPress que escala a filtrado de la ai1wmsecretkey y, con ella, a ejecución remota de código RCE. Lee esto en: English · Español | ---|---...
CVE-2026-105059
Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...
CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...