Joomla! Component User Status - Local File Inclusion Detection

A directory traversal vulnerability in userstatus.php in the User Status comuserstatus component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

Seldon Core - Detect

Seldon Core, an open-source MLOps/LLMOps framework for deploying, monitoring, and scaling machine learning models on Kubernetes, was detected. Its Pipeline Gateway component, which routes inference requests between chained model pipelines, exposed an unauthenticated status endpoint returning a...

APC UPC Multimon Status Page - Detect

Multimon UPS status page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multimon UPS status page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'APC UPC Multimon Status Page - Detect',...

ViewPoint System Status Detection

ViewPoint System status page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ViewPoint System status page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ViewPoint System Status Detection',...

Jellyfin Public Users - Exposure Detection

The Jellyfin media server exposed user information via the public users API endpoint. This endpoint could have leaked sensitive data including usernames, user IDs, server IDs, administrator status, password configuration, login activity, and user policies without authentication. !/usr/bin/env...

Nagios Current Status Page - Detect

Nagios current status page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nagios current status page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nagios Current Status Page - Detect',...

GLPI Status Page - Detect

A php status page that indicates if local or ldap identity is used for glpi. !/usr/bin/env python3 -- coding: utf-8 -- """A php status page that indicates if local or ldap identity is used for glpi.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

VerneMQ Status Page Detection

VerneMQ Status Page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """VerneMQ Status Page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VerneMQ Status Page Detection', 'description': 'VerneMQ...

CirCarLife <4.3 - Improper Authentication Detection

CirCarLife before 4.3 is susceptible to improper authentication. A PLC status disclosure exists due to lack of authentication for /html/devstat.html. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

Ngrok Status Page Detection

Ngrok is a popular platform that provides secure tunnels to localhost, allowing users to expose a local web server to the internet.The Ngrok status page is a web page that provides real-time information about the health and performance of the Ngrok service. !/usr/bin/env python3 -- coding: utf-8 ...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

EUVD-2026-49752

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

The CVE-2026-18029 entry is tied to the pretix-girosolution payment integration. Affected component: payment status validation in GiroCheckout flow. Root cause: insufficient validation of payment status responses, enabling an attacker to reuse a successful status for one payment with a different ...

CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-57213

A flaw was found in the RabbitMQ rabbitmqfederationmanagement plugin. This cross-site scripting XSS vulnerability occurs because the consumertag field on the Federation Status page does not properly escape HTML. A user with permissions to configure a federation upstream or policy can exploit this...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

CVE-2026-15012

creationtimestamp| type| source ---|---|--- 2026-07-28 08:43:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrozfdydns2s...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...