Lucene search
+L

77077 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.54 views

PyTorch TorchServe SSRF

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

10CVSS7.2AI score0.355EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.56 views

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

6.1CVSS6.3AI score0.01224EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.105 views

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

6.1CVSS6.4AI score0.01107EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.117 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteinquiry. id: CVE-2022-31978 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: critical description: | Online Fire Reporting System v1.0 is vulnerable to...

9.8CVSS7.3AI score0.07224EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.77 views

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

10CVSS7.5AI score0.88099EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.201 views

Hotel Druid 3.0.2 - Cross-Site Scripting

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. id: CVE-2021-37833 info: name: Hotel Druid 3.0.2 - Cross-Site Scripting author: pikpikcu,s4e-io severity: medium description: Hotel Druid 3.0.2 contains a...

6.1CVSS6.5AI score0.04878EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.161 views

Kramer VIAware - Remote Code Execution

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames. id: CVE-2021-36356 info: name: Kramer VIAware - Remote Code Execution author: gy741 severity: critical description: KRAMER...

10CVSS7.7AI score0.70753EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.77 views

Haraj 3.7 - Cross-Site Scripting

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. id: CVE-2022-31299 info: name: Haraj 3.7 - Cross-Site Scripting author: edoardottt severity: medium...

6.1CVSS6.4AI score0.05045EPSS
SaveExploits2References5
Kitploit
Kitploit
added 2026/08/31 4:37 a.m.3 views

CVE-2025-41088

CVE-2025-41088: Stored XSS in Xibo CMS I have discovered a Stored Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This vulnerability allows an authenticated attacker to inject malicious scripts into the application due to improper validation of user-supplied input. The issue resides in...

5.1CVSS6AI score0.0034EPSS
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/08/31 4:12 a.m.12 views

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

9.1CVSS6.8AI score0.01557EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/08/31 4:05 a.m.4 views

CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

8.8CVSS6AI score0.00478EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/31 3:59 a.m.5 views

CVE-2025-24963

CVE-2025-24963 - Vitest Browser Mode - Local File Read ​CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...

7.5CVSS6.8AI score0.02384EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 3:56 a.m.4 views

Blackash-CVE-2025-48593

🚨 CVE-2025-48593 Zero-Click Remote Code Execution in Android System 🚨 "A single malicious packet can own your device." — Android Security Team, Nov 2025 🎯 Vulnerability Snapshot Attribute| Details ---|--- CVE ID| CVE-2025-48593 Severity| 🔴 Critical RCE, Zero-Click CVSS Est.| 9.8 Pending NVD...

8.4CVSS7.3AI score0.00894EPSS
SaveExploits4
RedHat Linux
RedHat Linux
added 2026/08/31 3:46 a.m.5 views

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

7.5CVSS6AI score0.00412EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/08/31 3:43 a.m.3 views

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / local file read via response URL CVE-2026-13233 Untrusted upstream: the provider that fetched the URL its response told it to. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status: Coordinated disclosure complete...

3.3CVSS5.9AI score0.00208EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/31 3:40 a.m.7 views

CVE-2020-11890

Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...

5.3CVSS6.1AI score0.02761EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/31 3:35 a.m.4 views

CVE-2022-24086

CVE-2022-24086 CVE-2022-24086 about Magento RCE Description Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result i...

10CVSS7.5AI score0.99199EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/08/31 3:28 a.m.4 views

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Vulnerability CVE-2024-48589 Summary: A Cross-Site Scripting XSS vulnerability was discovered in the rol parameter of index.php or the path section in the phpAbook application. This vulnerability allows an attacker to inject arbitrary JavaScript code into ...

6.3CVSS6AI score0.00601EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/31 3:21 a.m.5 views

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

9.8CVSS7.3AI score0.01126EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 3:05 a.m.3 views

CVE-2026-23744-poc

CVE-2026-23744 — mcpJam Remote Code Execution RCE Exploit A Python 3 proof-of-concept exploit for CVE-2026-23744 , an arbitrary command execution vulnerability affecting mcpJam v1.4.2. This utility automates payload delivery by transparently Base64-encoding commands before transmission, helping...

9.8CVSS6.3AI score0.45026EPSS
SaveExploits39
Rows per page
Query Builder