CVE-2023-43284

CVE-2023-43284 DLink Model DIR-846 Authenticated Remote Code Execution. This flaw abuse QoS POST parameter in the router to exploit an Authenticated Remote Code Execution. Doesn't require QoS be enabled! root@kitploit: -h, --help show this help message and exit -x , --command Command to be execut...

CVE-2020-17496

CVE-2020-17496 root@kitploit: POST /ajax/render/widgettabbedcontainertabpanel?XDEBUGSESSIONSTART=phpstorm HTTP/1.1 Host: localhost User-Agent: curl/7.54.0 Accept: / Content-Length: 100 Content-Type: application/x-www-form-urlencoded subWidgets0template=widgetphp&subWidgets0configcode=echo...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Inyección SQL no autenticada Descripción El plugin Likes and Dislikes Plugin para WordPress es vulnerable a inyección SQL a través del parámetro 'post' en todas las versiones hasta la 1.0.0 incluida, debido a un escapado insuficiente en el parámet...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Inyección SQL sin autenticación 🧠 ID de CVE: CVE-2025-5287 Descubierto por: KhaledAlenazi Nxploited Publicado el: 27 de mayo de 2025 📋 Descripción El plugin Likes and Dislikes para WordPress es vulnerable a inyección SQL a través del parámetro post ...

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

CVE-2025-50867

Existe una vulnerabilidad de inyección SQL en el endpoint takeassessment2.php de CloudClassroom-PHP-Project 1.0, donde el parámetro POST Q5 se inserta directamente en sentencias SQL sin desinfección. Tipo de Vulnerabilidad : Inyección SQL Proveedor del Producto :...

cve-2018-1273

CVE-2018-1273 Spring Data Commons RCE Vulnerabilidad de ejecución remota de comandos uso root@kitploit: C:\Users\CTF\Desktoppython cve-2018-1273.py / / | / / /| |/ : touch /tmp/jas502n 405, May Have a CVE-2018-1273 vulnerability! CVE-2018-1273 Vulnerability Exit! Cmd : Solicitud de BurpSuite:...

CVE-2023-31717

CVE-2023-31717 Возможна SQL-инъекция в параметр id HTTP POST, передаваемый в теле в формате JSON, что позволяет извлекать конфиденциальную информацию из базы данных SQLite Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND 'MIZH'='MIZH"...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Cross-Site Scripting reflejado XSS Tabla de contenidos Descripción general Detalles de la vulnerabilidad Producto afectado Análisis técnico Prueba de concepto Pasos para reproducir Impacto Mitigación y remediación Referencias Descargo de responsabilidad...

CVE-2026-2058-PoC

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection Overview A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project v1.0. The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to databas...

CVE-2021-43650

CVE-2021-43650 Webrun = 3.6.0.42 SQLi Descripción Webrun es una aplicación de gestión basada en web. En la versión 3.6.0.42 fue posible identificar y reportar una vulnerabilidad de inyección SQL que ocurre durante el proceso de inicio de sesión; más específicamente, inyectaremos el payload en el...

CVE-2019-20197

Vulnerabilidad de ejecución remota de comandos en Nagios XI CVE-2019-20197 PoC： POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

CVE-2025-5287

CVE-2025-5287 PoC Exploit de inyección SQL no autenticada para WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Descripción Este script de Python es un exploit de prueba de concepto PoC para CVE-2025-5287 , que apunta a una vulnerabilidad en WordPress Likes and Dislikes Plugin ≤ 1.0.0. La...

CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75170

This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...