CVE-2026-62137 WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in bbPress = 2.6.14 versions...

EUVD-2026-76200

Unauthenticated Sensitive Data Exposure in bbPress = 2.6.14 versions...

CVE-2026-62137

An unauthenticated Sensitive Data Exposure vulnerability affects the WordPress bbPress plugin in versions 2.6.14 and earlier , as discovered by Ananda Dhakal via Patchstack . The flaw allows a remote attacker with no prior access to expose sensitive data, carrying a CVSS 3.1 score of 5.3 (Medium)...

CVE-2022-36539

CVE-2022-36539 안전하지 않은 직접 객체 참조IDOR WeDayCare B.V. WeDayCare B.V Ouderapp v1.1.22 미만 버전에서 공격자가 가로챈 호출 내 ID 값을 변경하여 다른 부모 및 아동의 데이터에 접근할 수 있습니다. API 트래픽은 Burp Suite와 같은 프록시를 통해 투명하게 노출됩니다. 인증 없이는 접근할 수 없지만, 인가Authorization는 적용되지 않은 것으로 보입니다. 이렇게 하면 내 자녀의 데이터뿐만 아니라 다른 자녀의 데이터도 요청할 수 있습니다. 이를 통해 GDP...

Octopii

Octopii root@kitploit: ⠀⠀⠀⠀⠀⠀⠀⣤⣤⣄⣀⡀⠀⠀⠀⢀⣠⣤⣤⣄⡀⠀⠀⠀⢀⣀⣠⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠸⣿⣿⡿⠿⢿⣷⡄⢠⣿⣿⣿⣿⣿⣿⡄⢀⣾⡿⠿⢿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠈⠉⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣠⣤⡀⠀⠀⠀⠀⠀⠀⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⠀⠀⠀⠀⠀⠀⢀⣤⣄⠀⠀⠀ ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⢸⣿⡇⢸⣿⣿⣿⣿⣿⣿⡇⢸⣿⡇⠀⣴⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀ ⠀⠉⠉⠁⠀⠀⠀⠀⣿⣿⠀⢸⣿⡇⠀⠉⣿⣿⣿⣿⠉⠀⢸⣿⡇⠀⣿⣿⠀⠀⠀⠀⠈⠉⠉⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣀⣈⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⣁⣀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀...

CVE-langgraph

cve-id ⚡ 簡単な使い方 このプロジェクトは、以下のような安全かつ許可された環境でのみ使用してください： ローカル仮想マシン Dockerコンテナ 隔離されたラボ環境 許可されたペネトレーションテスト環境 セットアップ例： root@kitploit: git clone cd Project use python follow below Create a virtual environment python -m venv venv Activate the virtual environment macOS / Linux source venv/bin/activate...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-공격-사후-보고서 이 사후 보고서는 Oracle Cloud의 ID 및 인증 인프라를 표적으로 한 2025년 공급망 침해 사고를 분석합니다. 위협 행위자가 레거시 Oracle Access ManagerOAM 인스턴스에서 패치되지 않은 사전 인증 원격 코드 실행 취약점CVE-2021-35587, CVSS 9.8을 악용하여 인증 토큰을 위조하고 수개월간 탐지되지 않은 채 활동한 방법을 상세히 설명합니다. 이 보고서는 140,000개 이상의 테넌트에 영향을 미치고 600만 건의 사용자 레코드를...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: ETHCheat를 통한 ZTE H298A / H108N 비밀 유출 인증되지 않은 ETHCheat=1 요청이 영향을 받는 ZTE ZXHN H298A 1.1 및 H108N 2.6 라우터가 응답 마크업에서 활성 관리자 비밀번호, ESSID 및 WLAN PSK를 반환하도록 만드는 CVE-2026-34474에 대한 기술적 분석입니다. 요약 관찰된 익스플로잇 경로는 인증되지 않은 관리 페이지 정보 노출입니다. getpage.lua?pid=1000&ETHCheat=1에 대한 조작된 GET 요청은...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 설명 이 스크립트는 CVE-2024-24919 Checkpoint Security Gateway 무단 정보 공개 취약점의 익스플로잇을 자동화합니다. 📌 기능 ✅ 단일 및 대량 URL 테스트 ✅ 자동화된 익스플로잇 ✅ 간단하고 빠름 🛠️ 사용 방법 이 저장소를 클론하고 스크립트를 실행하세요: root@kitploit: git clone https://github.com/spider00009/CVE-2024-24919-POC.git cd CVE-2024-24919-POC python...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – GraphQLバッチ処理エイリアスによるレート制限バイパス プログラムコード（Node.js + Pythonエクスプロイト） root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql'; const schema =...

CVE-2026-89173

The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...

EUVD-2026-76000

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

poc-graphql

Table Of Content Table Of Content Research on GraphQL Objective Labs Deploying on Docker Security weaknesses Authorization Issue Reco Injection Issue Reco Resource exhaustion Issue Reco Exposure of private data Issue Reco Exposure of technical information in case of unexpected error Issue Reco...

PT-2026-90514

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

PT-2026-90358

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache isize extended in cifs setsize when extending cifs setsize calls truncate pagecache but skips pagecache isize extended on extension. truncate setsize shows the correct pattern: i size writeinode, newsize; if...