CVE-2026-81684

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 contain an information disclosure flaw in its desktop GUI. The steganography password is passed to a CLI child process via the --stego-password command-line argument (on both encrypt and decrypt paths) rather than through an environme...

CVE-2026-81682

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...

CVE-2026-81679

OpenRemote versions before 1.28.0 are affected by a cross-realm information disclosure vulnerability in the Notification REST API . An attacker with read:admin credentials in a single realm can issue a zero-parameter GET request to the notification endpoint and retrieve sent notification metadata...

EUVD-2026-67035

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81664

OpenFaaS gateway versions 0.27.11 through 0.27.13 contain a missing authentication flaw on the GET /system/telemetry route. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrap block, so when basic_auth is enabled the route still forwards requests to the provider without a cr...

WordPress-Exploit-CVE-2024-1071

Exploit SQL WordPress CVE 2024-1071 Questo exploit, che funziona sulle versioni di WordPress dalla 2.1.3 alla 2.8.2, consente ad attaccanti non autenticati di aggiungere query SQL aggiuntive a query esistenti, che possono essere utilizzate per estrarre informazioni sensibili dal database. Dork:...

CVE-2025-7775

CVE-2025-7775 Rilevamento versione PowerShell C'è anche un metodo basato su hash di file: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py Puoi anche potenzialmente usare i binari del client per enumerare la versione non sono sicuro se sia necessaria...

CVE-2019-18988

CVE-2019-18988 Entschlüsselung gespeicherter TeamViewer-Anmeldeinformationen...

ecologyExp.jar

ecologyExp.jar Чтение файла конфигурации базы данных Weaver OA java -jar ecologyExp.jar http://127.0.0.1 Исходный код package com.test; import org.apache.http.HttpEntity; import org.apache.http.client.methods.CloseableHttpResponse; import org.apache.http.client.methods.HttpGet; import...

CVE-2019-5489

CVE 2019-5489 इस रिपॉजिटरी में Linux के लिए Page Cache Side Channel Attacks CVE-2019-5489 का प्रूफ ऑफ कॉन्सेप्ट है। पेज कैश साइड चैनल का मूल्यांकन करने के लिए, मैंने दो प्रक्रियाओं के बीच कोवर्ट चैनल लागू किया है। सेंडर प्रक्रिया पेज कैश साइड चैनल के माध्यम से रिसीवर प्रक्रिया को गोपनीय डेटा भेजत...

CVE-2018-3639

CVE-2018-3639 Bypass speculativo del negozio CVE-2018-3639 proof of concept per Linux Scarica root@kitploit: git clone [email protected]:mmxsrup/CVE-2018-3639.git Compila root@kitploit: cd CVE-2018-3639 make Esegui root@kitploit: ./specter Output root@kitploit: $ ./spectre idx: 0, highest:P,...

cve-2023-32784

CVE-2023-32784 KeePass 2.X versione 2.54 è suscettibile a una vulnerabilità per cui la password principale può essere recuperabile da un dump di memoria di un database KeePass sbloccato. A questo è stato assegnato CVE-2023-32784 Questo programma mira a recuperare la password principale da un dump...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP-Whitelist-Umgehung CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Referenzen: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED löst die Client-IP aus den vom Angreifer kontrollierten Headern X-Forwarded-For dann Client-IP auf, bevor auf REMOTEADDR zurückgegriffen wird. Es gibt...

CVE-2026-52776

A flaw was found in compliance-trestle. The URLSecurityValidator, intended to prevent Server-Side Request Forgery SSRF, contains a bypass vulnerability. This bypass occurs because the validator does not properly handle IPv4-mapped IPv6 addresses or the unspecified address 0.0.0.0. A remote...

CVE-2026-11106-DNS-Zone-Transfer-AXFR-Information-Disclosure

CVE-2026-11106 – Divulgazione di informazioni sul trasferimento di zona DNS AXFR Codice del programma server DNS Python + attacco root@kitploit: dnsserversim.py - Simulated DNS server allowing AXFR from dnslib import DNSRecord, QTYPE, RR, TXT, A import socketserver, socket class...

CVE-2021-47996

A flaw was found in Nokogiri, specifically within its bundled libxml2 library. A remote attacker could exploit multiple vulnerabilities, including memory leaks, buffer over-reads, heap-based buffer overflows, and out-of-bounds reads, by processing specially crafted XML documents. This could lead ...

CVE-2023-26258-ArcServe

Das TL; DR; Wenn du im Netzwerk bist, kannst du mit ArcServeRadar.py nach standardmäßig konfigurierten Instanzen scannen. Ich habe versucht, es nach C zu portieren, aber es nicht geschafft – wenn du weißt, wie es geht, kannst du das gerne tun : root@kitploit: c:\Users\vagrant\Desktoppython...

CVE-2021-33558.

CVE : CVE-2021-33558. Codice exploit di CVE-2021-33558 Sommario In Boa/0.94.13 ci sono varie configurazioni errate. Espone varie informazioni sensibili. Prova di concetto https://target.com/backup.html https://target.com/preview.html https://target.com/js/log.js https://target.com/log.html...

CVE-2024-22275

CVE-2024-22275: Lettura parziale di file in VMware vCenter Server Il vCenter Server contiene una vulnerabilità di lettura parziale dei file. Un attore malintenzionato con privilegi amministrativi sulla shell dell'appliance vCenter potrebbe sfruttare questo problema per leggere parzialmente file...

CVE-2026-79674

A flaw was found in NLTK. A path traversal vulnerability in corpus-reader constructors allows a remote attacker to bypass the intended data root sandbox. By supplying arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors, an attacker can read files and...