Lucene search
+L

193057 matches found

Kitploit
Kitploit
•added 2026/09/25 2:48 a.m.•38 views

ansvif

ansvif A Not So Very Intelligent Fuzzer Marshall Whittaker oxagast [email protected] As the complexity of a system rises, as does the potential for problems within that system. --Whittaker's Law Compile Dependancies: automake autoconf-archive zlib1g-dev g++ gcc and libgtk2.0-dev if you want...

5.4AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 2:47 a.m.•38 views

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

6.7AI score
SaveExploits0References11
Kitploit
Kitploit
•added 2026/09/25 2:34 a.m.•13 views

CVE-2019-17625

CVE-2019-17625 There is a stored XSS vulnerability in rambox 0.6.9 due to unsantized parameters in the name field when a user is adding a service. Since rambox runs on NodeJS this allows for the use of OS commands to be injected into an or tag. Note: This code has only been tested on MacOS and ma...

9CVSS8.1AI score0.03019EPSS
SaveExploits2
Kitploit
Kitploit
•added 2026/09/25 2:06 a.m.•9 views

CVE-2020-10199

CVE-2020-10199 Echo version, casually written untested bug root@kitploit: Usage: python http://127.0.0.1:8080 username password Reference: https://www.cnblogs.com/magic-zero/p/12641068.html...

9CVSS8.1AI score0.99064EPSS
SaveExploits10
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•126 views

Hongdian H8922 3.0.5 Devices - Local File Inclusion

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out wi...

6.5CVSS7.1AI score0.1592EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•99 views

Aryanic HighMail (High CMS) - Cross-Site Scripting

A cross-site scripting vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. id: CVE-2020-23517 info: name: Aryanic HighMail High CMS - Cross-Site Scripting author: geeknik severity: medium...

6.1CVSS6.3AI score0.07051EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•47 views

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

7.5CVSS7.4AI score0.01765EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•63 views

Nevma Adaptive Images - Arbitrary File Deletion

Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters. id: CVE-2019-14206 info: name: Nevma...

7.5CVSS7.7AI score0.04728EPSS
SaveExploits2References6
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•131 views

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

9.8CVSS6.3AI score0.86692EPSS
SaveExploits6References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•11 views

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

6.1CVSS6.1AI score0.00643EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•25 views

WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

8.2AI score0.00601EPSS
SaveExploits1References1
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•30 views

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

5.7AI score0.01216EPSS
SaveExploits3References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•31 views

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection

Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignalexternalid' and 'onesignalgetsubscriptionoptionsid' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficie...

5.7AI score0.02758EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•29 views

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

7.5CVSS7.4AI score0.30987EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•48 views

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

6.5CVSS7.1AI score0.00559EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•46 views

WP Triggers Lite - Cross-Site Scripting

WP Triggers Lite WordPress plugin v2.5.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

8.1AI score0.00571EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•26 views

Blesta <= 5.13.1 - Cross-Site Scripting

Blesta 3.x through 5.x before 5.13.3 contains an input validation vulnerability caused by mishandling input, letting attackers potentially exploit the system, exploit requires unspecified conditions. id: CVE-2026-25616 info: name: Blesta = 5.13.1 - Cross-Site Scripting author: 0xAkoko severity:...

6.1CVSS6AI score0.00444EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•82 views

XWiki - Open Redirect

XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0. id: CVE-2023-32068 info: name: XWiki - Open Redirect author:...

6.1CVSS6.4AI score0.5507EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•47 views

Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication. id: CVE-2017-9965 info: name: Schneider Electric Pelco VideoXpert...

5.8CVSS6.4AI score0.04612EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•16 views

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

6.1CVSS5.8AI score0.00591EPSS
SaveExploits0References2
Rows per page
Query Builder