68105 matches found
CVE-2025-14847
CVE-2025-14847 Descrizione CVE-2025–14847, nota anche come MongoBleed, è una vulnerabilità che consente agli attaccanti di eseguire letture non autorizzate di dati dallo spazio di memoria heap del server su cui viene eseguito il database MongoDB, senza autenticazione. Come riprodurre root@kitploi...
CVE-2020-13937
CVE-2020-13937 1. Descrizione della vulnerabilità: Apache Kylin dispone di un'API RESTful che espone le informazioni di configurazione senza alcuna autenticazione. 2 Riproduzione Confronto con vulnerabilità Confronto senza vulnerabilità Scrittura del PoC Verifica di un singolo URL corretto:...
CVE-2023-30367-mRemoteNG-password-dumper
mRemoteNG = v1.77.3.1784-NB Passwort-Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG ist eine freie Software, die es Benutzern ermöglicht, Multi-Protokoll-Verbindungskonfigurationen zu speichern und zu verwalten, um sich remote mit Systemen zu verbinden...
CVE-2026-44706
SQL Injection in Chatwoot FilterService Una proof-of-concept per CVE-2026-44706, una vulnerabilità di SQL Injection nel FilterServiceltgtfiltervalues di Chatwoot che permette a qualsiasi agente autenticato di leggere l'intero database PostgreSQL, incluse le credenziali utente e i token API. Leggi...
CVE-2023-28432
CVE-2023-28432 CVE-2023-28432 POC Minio è un framework di archiviazione di oggetti multi-cloud. In una distribuzione cluster a partire da RELEASE.2019-12-17T23-16-33Z e precedente a RELEASE.2023-03-20T20-16-18Z, MinIO restituisce tutte le variabili d'ambiente, incluse MINIOSECRETKEY e...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-16984
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
CVE-2023-23752
CVE-2023-23752 यह CVE-2023-23752 कमज़ोरी के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट कोड है। यह एक हमलावर को लक्ष्य एप्लिकेशन से उपयोगकर्ता नाम, पासवर्ड और डेटाबेस नाम जैसी संवेदनशील जानकारी निकालने की अनुमति देता है। उपयोग इस कोड का उपयोग करने के लिए, आप इन चरणों का पालन कर सकते हैं: 1. इस रिपॉजिटरी को क्लोन...
CVE-2021-3019
Lanproxy निर्देशिका ट्रैवर्सल भेद्यता CVE-2021-3019 भेद्यता विवरण Lanproxy एक इंट्रानेट पेनेट्रेशन टूल है जो LAN पर्सनल कंप्यूटर और सर्वर को पब्लिक नेटवर्क पर प्रॉक्सी करता है। यह TCP ट्रैफ़िक फ़ॉरवर्डिंग का समर्थन करता है और किसी भी TCP अपर-लेयर प्रोटोकॉल इंट्रानेट वेबसाइट तक पहुँच, स्थानीय भुगत...
CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
CVE-2026-78146
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
EUVD-2026-66271
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
CVE-2026-19632
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...
sift
Sift Secrets Triage dell'esposizione di credenziali e dati sensibili per le condivisioni di file. Quando compare una condivisione aperta, la domanda non è mai "questo repo ha una chiave divulgata". È "cosa è stato esposto, e cosa devo revocare prima della chiusura dell'attività." sift è costruito...
EUVD-2026-66230
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...
CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...
CVE-2026-19632
CVE-2026-19632 affects the TranslatePress – Multilingual WordPress plugin (all versions ≤ 3.3.1). An unauthenticated attacker can retrieve a plaintext administrator password-reset URL via the trp_get_translations_regular AJAX action, which exposes dictionary rows from the secondary-language trans...
