CVE-2019-3929

CVE-2019-3929 Módulo de Metasploit para Inyección Remota de Comandos en Crestron/Barco/Extron/InFocus/TeqAV CVE-2019-3929 Según la descripción de Tenable: Un atacante remoto no autenticado puede ejecutar comandos del sistema operativo como root mediante solicitudes manipuladas al endpoint HTTP...

CVE-2026-46453

camel-elasticsearch-rest-client Reproduktion der Header-Injection ohne Präfix CVE-2026-46453 Dieses Projekt demonstriert eine Message-Header-Injection / Autorisierungsumgehung in der Apache Camel-Komponente camel-elasticsearch-rest-client, verfolgt als CVE-2026-46453. Die Komponente liest mehrere...

CVE-2026-23744

CVE-2026-23744 – Prova de Conceito O script Python nesta PoC envia uma simples requisição HTTP ao host alvo que executa o MCPJam inspector versão substitua pela sua porta de escuta Em seguida, abra outro shell e execute a PoC: root@kitploit: cd CVE-2026-23744 python3 exploit.py Referências RCE no...

CVE-2025-24893

CVE-2025-24893 Utilizzo root@kitploit: python CVE-2025-24893 http://target.com...

Copyparty <=1.18.6 - Cross-Site Scripting

Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. id: CVE-2025-54589...

CVE-2024-1561

CVE-2024-1561 - Gradio Beliebiger Dateizugriff CVE-2024-1561 ist eine Schwachstelle für beliebigen Dateizugriff, die Gradio -Versionen vor 4.13.0 betrifft. Gradio ist ein beliebtes Python-Framework, das verwendet wird, um schnell Weboberflächen für Machine-Learning-Modelle und KI-Anwendungen zu...

CVE-2021-26084

उपयोग: python poc.py http://host:port/...

CVE-2021-3019

CVE-2021-3019 ip.txt फ़ाइल में IP जोड़ें, ध्यान दें प्रारूप: http://127.0.0.1 प्रति पंक्ति एक Cheeetah खोलें, चलाएँ...

CVE-2021-37832

CVE-2021-37832 CVE 2021-37832 poc utilizzo : python3 CVE-2021-37832.py http://test.com...

PT-2026-82220

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

SECURITY-3314-3315

= SECURITY-3314/SECURITY-3315 Absicherung Dieses Repository dokumentiert Absicherungen, die die Ausnutzung von SECURITY-3314 und SECURITY-3315 auf betroffenen Instanzen verhindern. == Übersicht Der Zugriff auf die CLI muss deaktiviert werden. Beide folgenden Schritte müssen durchgeführt werden:...

CVE-2023-23752

Installation root@kitploit: git clone https://github.com/0xx01/CVE-2023-23752.git cd CVE-2023-23752 chmod +x exploit.sh Verwendung root@kitploit: ./exploit.sh http://localhost...

CVE-2026-76402

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure a non-secure Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise that causes the connector to send...

MAL-2026-12320 Malicious code in @lizhao1/memorax-code-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285 The npm postinstall script bin/memorax-code-plugin-postinstall.mjs unconditionally calls enableInternalDataCollectionConfig with no user prompt,...

Missing permission check in violation-comments-to-gitlab allows enumerating credentials IDs

violation-comments-to-gitlab 2.62.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

EUVD-2026-51807

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...