CVE-2026-90461

A flaw was found in OpenStack Ironic. When the Image Service is configured for HTTPS Basic Authentication, Ironic may inadvertently transmit a username and password to an unintended remote host. This could lead to the disclosure of sensitive authentication credentials to an attacker who controls...

CVE-2022-31890

CVE-2022-31890 for osTicket | 支持票务系统 昵称: root@kitploit: python nickname.py The output of the first nickname in the table. 密码: root@kitploit: python password.py The output of the first password in the table. 输出到文件: root@kitploit: python dumpFile.py cat dump.txt || nickname::password 输出到控制台:...

CVE-2017-7921

CVE-2017-7921 漏洞利用 该脚本允许与存在 CVE-2017-7921 漏洞的摄像头交互，执行以下操作： 1. 下载并解密配置文件，其中包含摄像头的管理员密码。 2. 每秒连续下载图像。 3. 将一系列下载的图像转换为视频。 依赖要求 Python 3.x requirements.txt 中列出的包。使用以下命令安装： root@kitploit: pip install -r requirements.txt 用法 该脚本接受以下参数： -p IP:PORT：下载并解密配置文件。 -s IP:PORT：每秒下载图像。图像保存在 snapshots/IP:PORT/ 文件夹...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061

An XML External Entity (XXE) vulnerability exists in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 . An actor with write access to the shared cache infrastructure can inject crafted XML data into a cached column value, allowing them to disclose sensitive fil...

EUVD-2026-76153

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-82583

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier are affected by a SQL injection vulnerability exploitable through the Database Connector API by an authenticated user with low privileges. The flaw can lead to disclosure of stored credentials for connected systems, arbitrary file write ,...

CVE-2026-82583 NextGen Healthcare Mirth Connect SQL Injection

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

EUVD-2026-76115

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 CVE-2026-34472 的技术解读：一个通过泄露凭据绕过认证的漏洞，影响 ZTE ZXHN H188A V6 固件。 摘要 在经测试的 H188A V6 版本中，对根路径的未认证请求可以触达登录前向导处理器，并泄露敏感数据，包括： WLAN PSK SSID PPPoE 用户名 Wi-Fi 密码（该密码随后会被转为大写并复用为默认管理员密码） 这正是该问题导致认证绕过而不仅仅停留在信息泄露的原因：在这台路由器上，泄露的 Wi-Fi 密码一旦转为大写，便成为默认管理员密码。该泄露通过暴露路由器后续进行授权访问时所需的精确密钥，跨越了认证边界。...

MoxaPass

Este es un exploit de ejemplo para CVE-2016-9361. Recupera la cadena de comunidad SNMP y la contraseña 'admin' para muchos tipos de dispositivos Moxa. Utiliza el protocolo de gestión propietario UDP/4800 de Moxa. El protocolo carece de seguridad, y usar el código de función 'unlock' no requiere...

DVRFaultNET

DVRFaultNET .NET 控制台应用程序，利用 DVR CVE-2018-9995 漏洞 使用方法 启动后，系统会提示您输入 DVR 摄像头的 URL。程序会在 URL 后添加 ?opt=user&cmd=list，并发送包含 "Cookie:uid=admin" 标头的请求，然后服务器返回一个 JSON 字符串，其中包含所有用户的凭据。...

Linux Distros Unpatched Vulnerability : CVE-2026-88056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

PT-2026-89878

CVE-2026-82583 CVSS 8.3 impacts Mirth Connect 4.7.1 and earlier. Authenticated users can execute arbitrary SQL via Database Connector, risking stored credential disclosure. Update if deployed. via NVD Recent High CVSS CyberSecurity InfoSec Vulnerability https://t.co/xBS3E6mUo3...

EUVD-2026-74270

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check...

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-88056

Angular's @angular/platform-server is vulnerable to SSRF and cross-origin credential disclosure prior to versions 20.3.30, 21.2.22, and 22.1.4 . The root cause is that the resolveUrl and parseUrl utilities invoked String.prototype.trim(), which strips leading Unicode whitespace (e.g. U+00A0, U+FE...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...