Lucene search
+L

996 matches found

Kitploit
Kitploit
added 2026/09/13 4:36 a.m.5 views

CVE-2023-43284

CVE-2023-43284 DLink Model DIR-846 Authenticated Remote Code Execution. This flaw abuse QoS POST parameter in the router to exploit an Authenticated Remote Code Execution. Doesn't require QoS be enabled! root@kitploit: -h, --help show this help message and exit -x , --command Command to be execut...

8.8CVSS7.9AI score0.01947EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/13 12:36 a.m.6 views

CVE-2020-17496

CVE-2020-17496 root@kitploit: POST /ajax/render/widgettabbedcontainertabpanel?XDEBUGSESSIONSTART=phpstorm HTTP/1.1 Host: localhost User-Agent: curl/7.54.0 Accept: / Content-Length: 100 Content-Type: application/x-www-form-urlencoded subWidgets0template=widgetphp&subWidgets0configcode=echo...

9.8CVSS9AI score0.8774EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 8:30 p.m.6 views

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Inyección SQL no autenticada Descripción El plugin Likes and Dislikes Plugin para WordPress es vulnerable a inyección SQL a través del parámetro 'post' en todas las versiones hasta la 1.0.0 incluida, debido a un escapado insuficiente en el parámet...

7.5CVSS6AI score0.02355EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/12 6:58 p.m.7 views

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Inyección SQL sin autenticación 🧠 ID de CVE: CVE-2025-5287 Descubierto por: KhaledAlenazi Nxploited Publicado el: 27 de mayo de 2025 📋 Descripción El plugin Likes and Dislikes para WordPress es vulnerable a inyección SQL a través del parámetro post ...

7.5CVSS5.8AI score0.02355EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/12 1:15 p.m.6 views

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

7.5CVSS5.9AI score0.00554EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 12:08 p.m.6 views

CVE-2025-50867

Existe una vulnerabilidad de inyección SQL en el endpoint takeassessment2.php de CloudClassroom-PHP-Project 1.0, donde el parámetro POST Q5 se inserta directamente en sentencias SQL sin desinfección. Tipo de Vulnerabilidad : Inyección SQL Proveedor del Producto :...

6.5CVSS5.8AI score0.0024EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/12 4:53 a.m.7 views

cve-2018-1273

CVE-2018-1273 Spring Data Commons RCE Vulnerabilidad de ejecución remota de comandos uso root@kitploit: C:\Users\CTF\Desktoppython cve-2018-1273.py / / | / / /| |/ : touch /tmp/jas502n 405, May Have a CVE-2018-1273 vulnerability! CVE-2018-1273 Vulnerability Exit! Cmd : Solicitud de BurpSuite:...

9.8CVSS8.2AI score0.97002EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/11 8:26 p.m.9 views

CVE-2023-31717

CVE-2023-31717 Возможна SQL-инъекция в параметр id HTTP POST, передаваемый в теле в формате JSON, что позволяет извлекать конфиденциальную информацию из базы данных SQLite Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND 'MIZH'='MIZH"...

7.5CVSS7.4AI score0.01555EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/11 5:10 a.m.10 views

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Cross-Site Scripting reflejado XSS Tabla de contenidos Descripción general Detalles de la vulnerabilidad Producto afectado Análisis técnico Prueba de concepto Pasos para reproducir Impacto Mitigación y remediación Referencias Descargo de responsabilidad...

5.4CVSS6AI score0.00762EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/10 12:59 a.m.8 views

CVE-2026-2058-PoC

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection Overview A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project v1.0. The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to databas...

9.8CVSS7.4AI score0.00486EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/09 11:45 a.m.5 views

CVE-2021-43650

CVE-2021-43650 Webrun = 3.6.0.42 SQLi Descripción Webrun es una aplicación de gestión basada en web. En la versión 3.6.0.42 fue posible identificar y reportar una vulnerabilidad de inyección SQL que ocurre durante el proceso de inicio de sesión; más específicamente, inyectaremos el payload en el...

9.8CVSS8.2AI score0.06158EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/08 4:11 p.m.7 views

CVE-2019-20197

Vulnerabilidad de ejecución remota de comandos en Nagios XI CVE-2019-20197 PoC: POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

9CVSS7.8AI score0.22404EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/06 1:43 p.m.5 views

CVE-2025-5287

CVE-2025-5287 PoC Exploit de inyección SQL no autenticada para WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Descripción Este script de Python es un exploit de prueba de concepto PoC para CVE-2025-5287 , que apunta a una vulnerabilidad en WordPress Likes and Dislikes Plugin ≤ 1.0.0. La...

7.5CVSS6AI score0.02355EPSS
SaveExploits4
Cvelist
Cvelist
added 2026/09/04 11:40 p.m.39 views

CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

9.1CVSS0.00331EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/04 4:17 p.m.4 views

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

6.1CVSS0.00244EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/04 12:00 a.m.11 views

CVE-2026-75170

This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...

6.1CVSS5.5AI score0.00244EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/04 12:00 a.m.32 views

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

0.00244EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.10 views

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

6.1CVSS5.5AI score0.00244EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/25 11:19 p.m.5 views

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

5.3CVSS5.6AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/25 11:27 a.m.29 views

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

4.3CVSS0.00222EPSS
SaveExploits0References6
Rows per page
Query Builder