EUVD-2026-62370

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18372

M-Files Web before version 26.8.16330.2 is affected by a CSS injection vulnerability. An authenticated vault administrator can inject arbitrary CSS into the web user interface displayed to other vault users, resulting in low integrity impact on both the vulnerable and subsequent systems. The CVSS...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...

CVE-2026-18371 HTML injection in M-Files Web

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

MAL-2026-14288 Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Zyxel ZyWALL USG Extract Hashes

Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. !/usr/bin/env python3 ...

Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

D-Link DVG-N5402SP Path Traversal

Module exploits D-Link DVG-N5402SP path traversal vulnerability, which allows reading files form the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DVG-N5402SP Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco Unified Multi Path Traversal

Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 --...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

PT-2026-80325

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

PT-2026-78292

Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.14 Description Insufficient sanitization of uploaded SVG files allows users with file upload capabilities, such as Authors, to upload files containing malicious JavaScript. This leads to Stored...

PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw exists in the Form widget of Elementor Pro, potentially affecting over 6 million active installations. The issue occurs when a public form contains at least one...

CVE-2026-76342: Incorrect Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-18372: Improper Neutralization of Input During Web Page Generation

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371: Improper Neutralization of Input During Web Page Generation

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...