Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload

Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56290 info: name: Page Builder CK = 3.5.10 - Unauthenticated Arbitrary File Uplo...

Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

XWiki < 14.10.14 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

SickChill - Open Redirect

SickChill's login endpoint's 'next' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page. id: CVE-2024-53995 info: name: SickChill - Open Redirect...

A5 Custom Login Page - Reflected XSS

A5 Custom Login Page WordPress plugin v2.8.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires a crafted URL or...

Hoppscotch <= 2026.2.1 - Open Redirect

Hoppscotch = 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as...

Kubio AI Page Builder <= 2.5.1 - Local File Inclusion

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubiohybridthemeloadtemplate function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

linkedin-extension-fingerprinting

LinkedIn Chrome Extension Fingerprinting LinkedIn silently probes for 2,953 Chrome extensions on every page load. Background This repository documents every extension LinkedIn checks for and provides tools to identify them. Data The complete list of extensions with names and Chrome Web Store link...

fockcache

fockcache FockCache - Minimalized Test Cache Poisoning Detail For Cache Poisoning : https://portswigger.net/research/practical-web-cache-poisoning FockCache FockCache tries to make cache poisoning by trying X-Forwarded-Host and X-Forwarded-Scheme headers on web pages. After successful result, it...

nexphisher

Project not maintained anymore. UseZPhisher Installation : apt update apt install git -y git clone git://github.com/htr-tech/nexphisher.git cd nexphisher SETUP : bash setup SETUP TERMUX : bash tmuxsetup Run : bash nexphisher Single Command : root@kitploit: apt update ; apt install git -y ; git...

CVE-2026-78685

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-78685 Le-yan｜Medical Practice Management System - Remote Code Execution

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

EUVD-2026-65270

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-78685

CVE-2026-78685 affects the Le-yan Medical Practice Management System , a web-based application for managing medical practices. The vulnerability is a Remote Code Execution (RCE) flaw that allows unauthenticated remote attackers to execute arbitrary OS commands by serving a crafted HTML page that ...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in its Twig sandbox configuration. Attackers with page-edit permission can leverage config.get() or config.toArray() within Twig templates to exfiltrate sensitive system configuration secrets (e.g., system.cache.redis.password) when confi...

EUVD-2026-65220

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

EUVD-2026-65205

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...