4315 matches found
CVE-2026-82190
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
filessh
FileSSH A TUI-based file explorer for SSH servers, which allows you to browse and manage files on a remote server, edit them in-place, and recursively download directories with parallel directory traversal. It also has the ability to quickly spawn SSH sessions to paths on the remote server...
BitLeak
BitLeak BitLeak is a Python tool that check and display torrent downloads linked to a given IP address. root@kitploit: git clone https://github.com/AnkhCorp/BitLeak.git root@kitploit: pip3 install -r requirements.txt root@kitploit: python bitleak.py...
WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
WordPress Easy Digital Downloads plugin 3.1.0.2 and 3.1.0.3 contains a SQL injection vulnerability in the s parameter of its edddownloadsearch action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...
Easy Digital Downloads - Privilege Escalation
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...
WordPress Candidate Application Form <= 1.3 - Local File Inclusion
WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. id: CVE-2015-1000005 info: name: WordPress Candidate Application Form = 1.3 - Local File Inclusion author: dhiyaneshDK severity: high...
Z-Downloads < 1.11.7 - Cross-Site Scripting
The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...
Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...
Wipro Holmes Orchestrator 20.4.1 - Information Disclosure
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12. id: CVE-2024-5057 info: name: WordPress Easy Digital Downloads = 3.2.12 - SQL Injecti...
hget
hget 이 프로젝트는 golang을 배워 유용한 것을 만들기 위한 개인 프로젝트입니다. 빌드 상태 : Install root@kitploit: $ go get -d github.com/huydx/hget $ cd $GOPATH/src/github.com/huydx/hget $ make clean install 바이너리 파일은 ./bin/hget에 빌드됩니다. /usr/bin 또는 /usr/local/bin에 복사하고 alias wget hget으로 wget을 완전히 대체할 수도 있습니다 :P Usage root@kitploi...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page...
CVE-2025-14783-POC
🧨 CVE-2025-14783: Easy Digital Downloads Account Takeover PoC "Trust is the most exploitable security flaw." 💀 Description This repository contains a functional Proof of Concept PoC for CVE-2025-14783 , a critical Password Reset Poisoning vulnerability in the Easy Digital Downloads EDD plugin for...
axios-ssrf
시작하기 루트, 백엔드, 프론트엔드 디렉토리에서 pnpm install을 실행하세요 루트 디렉토리에서 pnpm start:dev를 실행하세요 취약점 이 웹사이트는 다음에 게시되어 있습니다: https://axios-ssrf.onrender.com/ 서버사이드 요청 위조SSRF: SSRF 공격에 취약한 axios 버전을 일부러 사용했습니다. 검색창으로 이동하여 http://example.com과 같은 절대 URL을 입력하세요 경로 탐색Path Traversal: 다운로드 미들웨어는 경로 탐색 공격에 취약합니다. 이는 일반적인...
CVE-2026-87441
A flaw was found in Google Chrome. Missing authorization in the Downloads component allowed a remote attacker to bypass system access restrictions. This could be achieved by convincing a user to install a specially crafted Chrome extension...
CVE-2026-87503
Inappropriate implementation in Downloads in Google Chrome on on Andro...
CVE-2026-87451
Information leak in Downloads in Google Chrome prior to 153.0.8010.36...
CVE-2026-87649
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010...