acltoolkit

acltoolkit acltoolkit è un coltellino svizzero per abusi ACL. Implementa molteplici abusi ACL. Indice acltoolkit Indice Installazione Utilizzo Comandi get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installazione root@kitploit: pip install acltoolkit-ad...

CVE-2017-17562

CVE-2017-17562 non codificato da me...

EUVD-2026-68131

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...

CVE-2026-82475

iFlytek astron-agent through 1.1.1 is affected by an authorization bypass in the copyFlow endpoint , which fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers to overwrite other tenants' workflows or copy private workflows to read their definitions, re...

EUVD-2026-66214

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

asnap

Asnap Descrizione Asnap mira a rendere più semplice la fase di ricognizione fornendo dati regolarmente aggiornati su quali aziende possiedono quali indirizzi ipv4 o ipv6 e permette all'utente di automatizzare la scansione iniziale delle porte e dei servizi. root@kitploit: █████╗ ███████╗███╗ ██╗...

CVE-2026-18233

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

EUVD-2026-68047

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

OwnershipStealer

OwnershipStealer Questo codice C è un'applicazione console che tenta di assumere la proprietà di un file specificato. Logica del codice Il programma controlla prima se è stato specificato un nome di file come argomento della riga di comando e, in caso contrario, chiede all'utente di inserirne uno...

CVE-2026-82283

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

EUVD-2026-43001

Snipe-IT's import createdby can be overwritten...

CVE-2026-82290

Chainlit through version 2.12.0 fails to validate ownership of feedback records in its PUT and DELETE endpoints. The root cause is a missing ownership check, allowing authenticated attackers to delete or modify other users' feedback by supplying arbitrary feedback identifiers. The practical conse...

CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

EUVD-2026-67821

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

CVE-2026-82284

Quivr versions through 0.0.322 contain a missing ownership validation flaw in three chat API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. An authenticated attacker can leverage this to read other users' conversation histories (including...

EUVD-2026-67815

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...