CVE-2023-27163-POC

CVE-2023-27163 PoC de SSRF para Request-Baskets CVE-2023-27163 basado en este código de entr0pie. El PoC se ha ampliado para hacer fuzzing del contenido de otro servicio web local o no y devolver el contenido de los archivos encontrados. Uso root@kitploit: python3 CVE-2023-27163.py http://: -t...

CVE-2019-3799

CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal Spring Cloud Config, versiones 2.1.x anteriores a 2.1.2, versiones 2.0.x anteriores a 2.0.4, versiones 1.4.x anteriores a 1.4.6, y versiones antiguas sin soporte, permiten a las aplicaciones servir archivos de configuración arbitrario...

gortex-PoC

Seguimiento de enlaces simbólicos en el recorrido de archivos del indexador → Divulgación de contenido fuera del repositorio mediante searchtext Estado del CVE: solicitado, asignación pendiente. Este hallazgo se publica como GHSA-6vhf-4wcm-2r83. Tras la asignación del CVE, este repositorio se...

WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...

WordPress WC Fields Factory plugin < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability

Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

CVE-2026-93507

The WC Fields Factory WordPress plugin (versions before 4.1.11 ) is vulnerable to an authorization bypass because it fails to properly restrict access to or verify a nonce for a post-cloning action. This flaw allows users with Contributor-level privileges and above to duplicate arbitrary posts, r...

CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-86602 WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-86602

The WP Recipe Maker WordPress plugin (versions 10.3.0 - 10.8.1 ) is vulnerable to a content disclosure flaw due to a missing capability check in one of its AJAX actions . This vulnerability allows any authenticated user , such as a subscriber, to bypass intended restrictions and read the full con...

CVE-2019-5418

CVE-2019-5418 - Divulgación de contenido de archivos en Rails EDIT : esta CVE puede provocar una ejecución remota de código, más información: https://github.com/mpgn/Rails-doubletap-RCE Existe una posible vulnerabilidad de divulgación de contenido de archivos en Action View. Las cabeceras accept...

nextjs-CVE-2024-34351-_exploit

CVE-2024-34351 Exploit PoC de CVE-2024-34351 Falsificación de Solicitud del Lado del Servidor en Server Actions de Next.js · CVE-2024-34351 · Base de Datos de Avisos de GitHub Excavando en busca de SSRF en aplicaciones NextJS Resumen PoC para una explotación completa de SSRF en NextJS. Un atacant...

BIT-PYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-PYTHON-MIN-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-LIBPYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered...

CVE-2026-92422 Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered...

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered...

CVE-2026-16557 Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...

CVE-2026-16557

The Nimble Page Builder WordPress plugin through version 3.3.8 is missing an authorization check in the authenticated AJAX action sek_get_nimble_content_for_seo_plugins . This allows any authenticated user with Subscriber role or higher to retrieve the page-builder content of arbitrary non-public...

CVE-2026-16557 Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...