Lucene search
+L

813 matches found

Kitploit
Kitploit
added 2026/09/13 5:55 p.m.8 views

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

6.1CVSS6.8AI score0.012EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 9:39 a.m.6 views

HTC

Hackea el CCTV Credenciales de DVRs Expuestas | CVE-2018-9995 | El nombre de usuario filtrado por el CCTV para obtener acceso de inicio de sesión ¿Cómo Usar? root@kitploit: Open The https://www.zoomeye.org/ Search This Keyword '/login.rsp' Wait To Get IP and Port $ python3 thecctv.py Más...

9.8CVSS8.2AI score0.82608EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/13 5:17 a.m.6 views

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

9.8CVSS6.3AI score0.21687EPSS
SaveExploits9
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.41 views

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

9.8CVSS6.4AI score0.03106EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.65 views

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

5.3CVSS5.9AI score0.0747EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/12 11:31 p.m.11 views

CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentials Dump Author : Javier Carabantes Affected Software : XOne Web Monitor Software : https://xone.es/ Affected Version : 02.10.2024.530 framework 1.0.4.9 Description An unauthenticated SQL injection vulnerability has been discovered in t...

9.8CVSS5.9AI score0.0122EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 8:47 p.m.6 views

CVE-2026-8793

CVE-2026-8793 — Missing Brute-Force Protection on PaperCut NG Login Form Field| Details ---|--- CVE ID| CVE-2026-8793 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS Score| 5.3 Medium — standalone...

6.9CVSS5.9AI score0.0039EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 8:30 a.m.8 views

cve-2019-17240

Bludit = 3.9.22 - Bruteforce Mitigation Bypass This is small project where I rewrite this python script into golang. Purpose of this project was to learn Golang and understand how this exploit work. Usage root@kitploit: $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of...

9.8CVSS6.2AI score0.39598EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/10 8:56 p.m.8 views

CVE-2025-10294

Exploit: Bypass de autenticación mediante ownidsharedsecret vacío falsificación de JWT 1 Forjar un JWT válido usando una clave HMAC vacía root@kitploit: SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode...

9.8CVSS8.4AI score0.00765EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 5:15 p.m.5 views

CVE-2025-13390

CVE-2025-13390 WP Directory Kit El plugin WP Directory Kit para WordPress es vulnerable a un bypass de autenticación en todas las versiones hasta la 1.4.4 inclusive debido a una implementación incorrecta del algoritmo de autenticación en la funciónwdkgenerateautologinlink. Esto se debe a que la...

10CVSS7.7AI score0.04593EPSS
SaveExploits3References1
Kitploit
Kitploit
added 2026/09/10 7:51 a.m.10 views

CVE-2024-7591-PoC

CVE-2024-7591-PoC These PoC python scripts test the Kemp LoadMaster for remote code execution. THIS TOOL IS INTENDED FOR TESTING PURPOSES ONLY These scripts were based on Marius Walter's writeup on the specifics of this exploit. You can read their post at:...

10CVSS8.4AI score0.43844EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 9:16 p.m.7 views

CVE-2025-60375

CVE-2025-60375 — PerfexCRM Authentication Bypass Advisory ID: perfexcrm-auth-bypass-2025 CVE: CVE-2025-60375 Product: PerfexCRM Affected versions: versions prior to 3.3.1 3.3.1 Reported by: Ajansha Shankar, Ahamed Yaseen References: OWASP Authentication Cheat Sheet —...

7.3CVSS5.9AI score0.00279EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 5:51 p.m.8 views

CVE-2026-36959

CVE-2026-36959: Missing Rate Limiting on Login Endpoint CVE ID: CVE-2026-36959 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts Description The U-SPEED Router...

7.5CVSS5.9AI score0.00349EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/08 10:40 a.m.8 views

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

9.8CVSS7.7AI score0.87892EPSS
SaveExploits17
Nuclei
Nuclei
added 2026/09/08 9:47 a.m.15 views

DAEnetIP4 METO v1.25 - Session Hijacking

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. id: CVE-2025-28242 info: name: DAEnetIP4 METO v1.25 - Session Hijacking author: 0xAkoko severity: high...

9.8CVSS5.9AI score0.01805EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/06 12:51 p.m.8 views

CVE-2017-14980_syncbreeze_10.0.28_bof

Exploit - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 Este repositorio contiene un exploit de desbordamiento de búfer BOF de prueba de concepto para Sync Breeze Enterprise versión 10.0.28, dirigido a la vulnerabilidad identificada como CVE-2017-14980. Descripción La vulnerabilidad existe...

9.8CVSS8.2AI score0.22483EPSS
SaveExploits7
NVD
NVD
added 2026/09/04 6:18 p.m.7 views

CVE-2026-85636

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

6.9CVSS0.00433EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/04 6:00 p.m.8 views

CVE-2026-85636

A missing authentication vulnerability in jofpin trape 1.0.0 affects the Login Endpoint within the file core/stats.py , allowing remote attackers to manipulate the endpoint without proper authentication. The impact is a low confidentiality loss (CVSS 3.1 score 5.3 MEDIUM ; CVSS 4.0 score 6.9 MEDI...

6.9CVSS5.4AI score0.00433EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/09/04 6:00 p.m.5 views

CVE-2026-85636 jofpin trape Login Endpoint stats.py missing authentication

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

6.9CVSS0.00433EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/04 6:00 p.m.35 views

CVE-2026-85636 jofpin trape Login Endpoint stats.py missing authentication

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

6.9CVSS0.00433EPSS
SaveExploits0References7
Rows per page
Query Builder