CVE-2018-9995_dvr_credentials

Ferramenta mostrar credenciais de DVR root@kitploit: Título do Exploit: "Obtém credenciais de DVR" CVE: CVE-2018-9995 Pontuação Base CVSS v3: 7.3 / 10 String do Vetor CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Data: 09/04/2018 Autor do Exploit: Fernandez Ezequiel twitter:@capitanalfa...

shell-history-leaks

Badges Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capire come fare, forse non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install shell-history-leaks Esegui il comando qui sotto per verificare shell-history-leaks -h Configurazion...

phpinfo-files-leaks

Badges Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capire come fare, forse non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install phpinfo-file-leaks Esegui il comando qui sotto per verificare phpinfo-file-leaks -h Configurazioni ...

CVE-2026-18965

PayRange API lacks proper authorization on its management endpoints, allowing verbose details of every device on the PayRange network to be publicly accessible, with or without an account. Per CISA advisory ICSA-26-237-04, successful exploitation enables a remote attacker (authenticated or unauth...

CVE-2026-18965 Missing Authorization in PayRange API

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

CloudScraper

CloudScraper ist ein Tool zum Crawlen und Scrapen von Zielen auf der Suche nach Cloud-Ressourcen. Gib eine URL ein und es crawlt und durchsucht den Quellcode der gecrawlten Seiten nach Strings wie 's3.amazonaws.com', 'windows.net' und 'digitaloceanspaces'. AWS, Azure und Digital Ocean Ressourcen...

CVE-2026-81530

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-59301

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59302

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59292

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59288

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2023-31584

CVE-2023-31584 - Cross-Site-Scripting-Schwachstelle in cu/silicon GitHub-Link: https://github.com/cu/silicon Betroffene Version: 1 Schweregrad und CVSS: Wird aktualisiert, sobald die Überprüfung durch NIST abgeschlossen ist. Typ: Cross-Site-Scripting Grundursache: Fehlende ordnungsgemäße...

xpl-ModernWMS-CVE-2024-57698

Divulgação do Hash MD5 da Senha do Administrador - ModernWMS v1.0 - CVE-2024-57698 Um problema no modernwms v.1.0 permite que um invasor veja o hash MD5 da senha do administrador e outros atributos sem autenticação, mesmo após a configuração inicial e alteração de senha. Isso ocorre devido à...

unredacter

Unredacter Zeigt dir, warum du niemals, niemals, niemals Pixelierung als Schwärzungstechnik verwenden solltest. Für eine ausführlichere Erklärung, wie das funktioniert, wirf einen Blick auf meinen Blogbeitrag hier. So probierst du es aus Installiere die Abhängigkeiten: npm install Starte dann mit...

CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-77438

Trilium (open-source hierarchical note-taking app), in versions up to and including 0.103.0 , has an authorization flaw in its public share-search endpoint . The endpoint authorizes only the ancestor note supplied in the request, then performs a full-text search across the entire published subtre...

EUVD-2026-67230

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...