CVE-2025-51867

CVE-2025-51867 Descripción de la vulnerabilidad Deepfiction AI es una empresa de entretenimiento con inteligencia artificial cuya misión es revolucionar la narración de historias personalizadas. Deepfiction AI ofrece una aplicación web para crear historias mediante chats con un LLM, que es...

Airachnid-Burp-Extension

Extensión de Burp para Web Cache Deception Una extensión de Burp para probar aplicaciones en busca de vulnerabilidad al ataque Web Cache Deception. Una vez cargada la extensión, se puede acceder desde la pestaña Target - Sitemap y hacer clic derecho sobre el recurso que se desea probar. Aparecerá...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

LLMReaper

Passive LLM Conversation Capture & Sensitive Data Exposure Research Chromium MV3 Extension • Real-Time DOM Capture • Secret Detection • FastAPI Backend !WARNING This project is provided strictly for security research, educational use, and defensive awareness purposes. Unauthorized deployment...

github-dorks

Github Dorks La búsqueda de GitHub es una característica bastante potente y útil que se puede usar para buscar datos sensibles en repositorios. La colección de dorks de GitHub puede revelar información sensible personal y/u organizacional como claves privadas, credenciales, tokens de autenticació...

CVE-2024-50961

Exposición de Datos Sensibles CVE-2024-50961 Descripción En DonWeb Ferozo Hosting v1.1, un atacante remoto puede explotar parámetros de URL para acceder a datos sensibles, incluidas credenciales de base de datos. Los vectores de ataque incluyen la captura de tráfico de red, registros del servidor...

SwaggerSpy

SwaggerSpy Resumen SwaggerSpy es una herramienta diseñada para la Inteligencia de Fuentes Abiertas OSINT automatizada en SwaggerHub. Este proyecto tiene como objetivo agilizar el proceso de recopilación de inteligencia de APIs documentadas en SwaggerHub, proporcionando información valiosa para...

CVE-2026-104402

The Mindio Magic MCP WordPress plugin (versions

CNVD-2022-27366__CVE-2023-37621

CVE ID CVE-2023-37621 PRODUCTO Fronius Fronius Datalogger Web 2.0.5-4 VERSIÓN Fronius Fronius Datalogger Web 2.0.5-4 TIPO DE PROBLEMA Vulnerabilidad de acceso no autorizado DESCRIPCIÓN Fronius es un fabricante europeo de máquinas de soldadura. El acceso no autorizado a Fronius Datalogger Web...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Inclusión de Archivos Local : CVE-2022-21371 Versión afectada: Versión: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 y 14.1.1.0.0 Descripción: El producto Oracle WebLogic Server de Oracle Fusion Middleware componente Web Container es vulnerable a la...

CVE-2026-97307

The StylemixThemes Cost Calculator Builder WordPress plugin (versions up to and including 4.0.17 ) is vulnerable to an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This flaw allows an attacker to Retrieve Embedded Sensitive Data from the application. No specific expl...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

CVE-2023-49367

CVE-2023-49367 - Exposición de Datos Sensibles Exposición de datos sensibles en el Panel Web de la Impresora Kyocera Fabricante: Kyocera Corporation Versiones Afectadas: Command Center RX - EXOSYS M5521cdn Descripción Después de conectarse a la libreta de direcciones de la interfaz de Kyocera, se...

CVE-2020-29134

Totvs Fluig Platform Fluig is the productivity and collaboration platform that integrates with the ERP system, and your company's other systems to revolutionize the way you and your team work. CVE-2020-29134 The TOTVS Fluig platform allows path traversal via parameter encoded in base64. When...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...

ListingPro < 2.6.1 - Sensitive Data Disclosure

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...

Joomla! Component Music Manager - Local File Inclusion

A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

TrakSYS 11.x.x - Sensitive Data Exposure

A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been...

Scoold < 1.64.0 - Authentication Bypass

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...