CVE-2025-31161

CVE-2025-31161 は、CrushFTP 管理ファイル転送 MFT ソフトウェアにおけるユーザー認証の処理方法を攻撃者が制御できるようにする、重大な深刻度の脆弱性です。 影響を受けるバージョン: 10.0.0 から 10.8.3、および 11.0.0 から 11.3.0 エクスプロイトの概要: 既知のユーザー名を使用した、リモートかつ認証されていない CrushFTP への HTTP リクエストにより、ユーザーになりすまして、管理者操作やデータ取得を含むアクションを代わりに実行できます。 この脆弱性は、CrushFTP バージョン 11.3.1 以降および 10.8.4...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

androrat

androrat Android用リモート管理ツール Androratは、クライアント側がJava Android、サーバー側がJava/Swingで開発されたクライアント/サーバーアプリケーションです。 Androratという名前は、AndroidとRAT（Remote Access Tool）を組み合わせたものです。 これは4人のチームによる大学のプロジェクトとして開発されました。1ヶ月で完成しました。このアプリケーションの目的は、Androidシステムをリモートで制御し、そこから情報を取得することです。 技術的な事項...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

CVE-2026-94405

The Shahjada Download Manager WordPress plugin (versions up to 3.3.71 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as a Sensitive Data Exposur...

kyocera-cve-2022-1026_SOAP1.1

Kyocera cve-2022-1026 soap1.1 認可されたテストのみ。 このプロジェクトは、所有している、または明示的なテスト許可を得た環境での教育的および防御的な検証を目的として提供されています。所有または管理していないシステムに対して使用しないでください。 CVE-2022-1026 に関連する、Kyocera プリンタの露出チェックおよびデータ取得の Proof-of-Concept です。特に、SOAP 1.1 サービスを実装したレガシーデバイス に焦点を当てています。 脆弱性の概要 CVE-2022-1026 は、2021 年にペネトレーションテスト中に...

CVE-2026-103345

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

EUVD-2026-89389

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-97695

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.2 Description The tempurl middleware fails to reject the X-Copy-From header during PUT requests. Because a TempURL signature only validates the method, expiry, and path, the system relies on a list of...

PT-2026-95129

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description Improper state validation in Skia allows a remote attacker to obtain cross-origin data through the use of a crafted HTML page. Skia is a 2D graphics library used for rendering...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452data. The original logic for getting mma8452data is incorrect. The dev points to the device belonging to iiodev. We cannot use this dev to find the correct i2cclient. The...

CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

CVE-2026-19051

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...

CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...

CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

DEBIAN-CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

EUVD-2026-70371

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...