CVE-2026-118477

The KaliFast Project Management Platform is vulnerable to OS Command Injection via the ei_git_repo_url parameter in the Git remote configuration endpoint. An authenticated attacker (with free registration available) can exploit this flaw to execute arbitrary commands on the server with www-data p...

CVE-2026-118477 KaliFast Project Management Platform ei_git_repo_url OS Command Injection

The eigitrepourl parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker free registration available to execute arbitrary commands on the KaliFast server with www-data privileges...

spring4shell-scan

spring4shell-scan A fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities Features Support for lists of URLs. Fuzzing for more than 10 new Spring4Shell payloads previously seen tools uses only 1-2 variants. Fuzzing for HTTP GET and POST...

Smart s200 Management Platform v.S200 - SQL Injection

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component. id: CVE-2024-27718 info: name: Smart s200 Management Platform v.S200 - SQL Injection author:...

Kubernetes management platform Privilege Escalation

The vulnerability of the endpoints /api/restore and /api/users/admin/init of the Kubernetes management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

The Autonomous Engine Behind Remediation, and What Finally Makes It Safe

Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can 't match. Qualys's Enterprise TruRisk Management Platform closes that gap with autonomous remediation: exposures are prioritized by threat, business, and environmental context, then...

CVE-2026-54766 Vikunja: Project duplication bypasses write-permission check on the target parent project

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

CVE-2026-19764: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...

Dahua Smart Park Management Platform - Arbitary File Read Detection

Dahua Smart Park Management Platform is vulnerable to Local File Inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua Smart Park Management Platform is vulnerable to Local File Inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hikvision Springboot Env Actuator - Detect

The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks !/usr/bin/env python3 -- coding: utf-8 -- """The HIKVISION comprehensive security management...

HPE OneView - Panel Detect

HPE OneView is an infrastructure management platform that provides automated management, monitoring, and updates for HPE servers, storage, and networking resources through a unified interface. !/usr/bin/env python3 -- coding: utf-8 -- """HPE OneView is an infrastructure management platform that...

Mobile Management Platform Panel - Detect

Mobile Management Platform panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Mobile Management Platform panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mobile Management Platform...

EasyCVR User - Information Disclosure Detection

The EasyCVR Video Management Platform is vulnerable to user information leakage. This template checks for exposed user information through the endpoint /api/v1/userlist?pageindex=0&pagesize=10. !/usr/bin/env python3 -- coding: utf-8 -- """The EasyCVR Video Management Platform is vulnerable to use...

Dahua 'GetClassValue' - Remote Code Execution Detection

Remote Code Execution Vulnerability in Dahua Intelligent IoT Integrated Management Platform via GetClassValue.jsp. !/usr/bin/env python3 -- coding: utf-8 -- """Remote Code Execution Vulnerability in Dahua Intelligent IoT Integrated Management Platform via GetClassValue.""" import re from...

Arcane Login Panel - Detect

Detects the presence of the Arcane login panel, a modern Docker management platform. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Arcane login panel, a modern Docker management platform.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Dahua Intelligent IoT - Information Disclosure Detection

There is a vulnerability in the user login interface /evo-apigw/evo-oauth/oauth/token of Zhejiang Dahua Technology Co., Ltd. Intelligent IoT Integrated Management Platform. Users can successfully log in to the platform using justForTest/any password, causing information leakage. !/usr/bin/env...

Cassia Bluetooth Gateway Panel - Detect

Cassia Bluetooth Gateway Management Platform login page was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cassia Bluetooth Gateway Management Platform login page was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Pulse Security Debuts Operational Management Platform Built for Security Leaders

San Francisco, United States, 15th July 2026, CyberNewswire...

BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...

PYSEC-2026-1211 BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...