Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure

Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system. id: CVE-2024-3742 info: name: Electrolink FM/DAB/TV Transmitter controlloLogin.js - Credentials Disclosure author: Farish severity: high description: | Electrolink...

CentralSquare CryWolf - Path Traversal

A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf False Alarm Management through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information. id: CVE-2024-45241 info:...

FleetCart 4.1.1 - Information Disclosure

Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId". id: CVE-2024-5230 info: name: FleetCart 4.1.1 - Information Disclosure author: s4e-io severity: medium description: | Issues wi...

Netmaker - Hardcoded DNS Secret Key

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. id: CVE-2023-32077 info: name: Netmaker - Hardcoded DNS Secret Key author: iamnoooob,rootxharsh,pdresearch...

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...

Twitter-Info

Twitter Info A simple python script to grab Twitter account info like: Name Following Followers Likes Account date Profile picture just by username or profile link. Usage root@kitploit: python3 twitterinfo.py or Example Input root@kitploit: python twitterinfo.py ngll Output root@kitploit: Name:...

htshells

HTSHELLS - 通过 .htaccess 文件实现的自包含 Web Shell 及其他攻击。 攻击的命名方式为 module.attack.htaccess，并按攻击类型分组存放在目录中。选择你需要的攻击，将其复制到一个新文件并命名为 .htaccess，检查文件以确认在上传前是否需要编辑。除非文件另有说明，Web Shell 通过查询参数 c 执行命令。 要准备攻击，运行 ./prepare.sh file 生成待上传的 .htaccess 文件。示例： root@kitploit: $ ./prepare.sh shell/modphp.shell.htaccess ┬...

CVE-2022-2078

CVE-2022-2078 root@kitploit: $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...

juicy-php

juicy-php Juicy-php - finds PHP info files with juicy information...

D-Link DIR-605 - Information Disclosure

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page id: CVE-2021-40655 info: name: D-Link DIR-605 - Information Disclosure author: DhiyaneshDK severity: high...

Jakarta Tomcat 3.1 and 3.0 - Information Disclosure

Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access. id: CVE-2000-0760 info: name: Jakarta Tomcat 3.1 and 3.0 -...

printix-CVE-2022-30006

CVE-2022-30006 Lanzamiento Simple | Versión para imprimir Una vulnerabilidad de "Exposición de Información Sensible a un Actor No Autorizado" y/o "Método o Función Peligrosa Expuesta" en PrintixService.exe, en "Printix Secure Cloud Print Management" de Kofax Printix, versión 1.3.1156.0 e...

EUVD-2026-84499

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-63278 Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

EUVD-2026-84357

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

CVE-2026-89422

creationtimestamp| type| source ---|---|--- 2026-09-22 10:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw3xr7mxce25 2026-09-22 10:07:26+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw3y6cxksm25 2026-09-22 20:15:04+00:00| seen|...

CVE-2026-80255

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🚨 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🛡️ Descriptio...

Important: Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.2

Red Hat OpenShift Builds 1.8.2 Release of Red Hat OpenShift Builds 1.8.2...

CVE-2020-36079

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:10+00:00| seen| Telegram/ZCdi5I9p-Xc5z40zki51FeiOFOjVkkHbDLVUITujH0 2026-09-23 00:00:11+00:00| published-proof-of-concept| Telegram/ZCdi5I9p-Xc5z40zki51FeiOFOjVkkHbDLVUITujH0...