EUVD-2026-86620

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

CVE-2026-6084 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

CVE-2026-6084

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile application by Novadigits technologies, specifically within the API and management panel . The flaw is located in the server-side REST endpoint /inventory/configuration/variants, where the system fails to properly filter o...

CVE-2026-6083

The StockAgile application by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability within the API and management panel. The flaw exists in the REST endpoint /inventory/configuration/pricing-tiers, where the application fails to properly filter or validate input in pa...

CVE-2026-6083 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

EUVD-2026-86619

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

EUVD-2026-86618

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-6082

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel by Novadigits technologies. The flaw is located in the REST endpoint /inventory/configuration/payment-methods, where malicious JavaScript can be injected and persisted via parameters such as 'code'...

CVE-2026-6082 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-49772

The Events Calendar SQLインジェクション CVE-2026-49772 PoC 説明 CVE-2026-49772 は、WordPressプラグイン The Events Calendar における 認証されていないブラインドSQLインジェクション です。壊れたRESTパラメータバリデータ（validatecallback が検証を行わずクロージャを返す）により、実験的な tec/v1 REST APIの order パラメータが、未サニタイズのままSQLの ORDER BY 句に到達します。 root@kitploit: GET...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'cart_items[][product_name]' parameter. Because the ch...

CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86594

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-1388

CVE-2022-1388 F5のBIG-IP製品のiControl REST API機能にリモートコード実行の脆弱性が存在します。認証されていないリモート攻撃者は、これを悪用して認証をバイパスし、root権限で任意のコマンドを実行できます。 使い方 python3 f5bigipscanner.py...

EUVD-2026-86548

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

Nuclei-Template-Exploit-F5-BIG-IP-iControl-REST-Auth-Bypass-RCE-Command-Parameter

Nucleiテンプレート Exploit F5 BIG-IP iControl REST Auth Bypass RCE | コマンドパラメータ CVE-2022-1388 は、BIG-IP の iControl API の REST コンポーネントにおける認証バイパスの脆弱性であり、CVSSv3 スコア 9.8 が割り当てられています。iControl REST API は、BIG-IP デバイスの管理と設定に使用されます。CVE-2022-1388 は、BIG-IP を使用するデバイスの管理ポートまたはセルフ IP...

api-scanner-docker

API Scanner - セルフホストデプロイメント API Scanner は、OpenAPI/Swagger 仕様書と WSDL ファイルを使用して REST および SOAP API の脆弱性をスキャンする、自動化された API セキュリティテストツールです。 前提条件 Docker Engine 20.10+ Docker Compose v2 Python 3.6+（セットアップスクリプト用） 8 GB 以上の RAM（推奨: 16 GB） 20 GB のディスク容量 クイックスタート 1. このリポジトリをクローン root@kitploit: git clone...

St2-052

S2-052のPOCテスト（旧名：Tomcatへのwarデプロイ） 原文アドレス：http://blog.csdn.net/caiqiiqi/article/details/77861477 struts2の公式サイトから最後に影響を受けるバージョンstruts-2.5.12をダウンロードします。アドレス： http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip...

burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage root@kitploit: burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i,...