7044 matches found
CVE-2026-89173
The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...
CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...
ListingPro < 2.6.1 - Sensitive Data Disclosure
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...
Joomla! Component Music Manager - Local File Inclusion
A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...
Scoold < 1.64.0 - Authentication Bypass
Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...
TrakSYS 11.x.x - Sensitive Data Exposure
A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been...
DedeCMS 5.7.109 - Server-Side Request Forgery
Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...
Easy Appointments <= 3.12.21 - Information Disclosure
Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...
PraisonAI AgentOS - Information Disclosure
PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...
Netgear R6850 - Information Disclosure
Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details,...
Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code id: CVE-2023-6065 info: name: Quttera Web Malware Scanner = 3.4.1.48 - Sensitive Data Exposure...
WordPress JobWP Plugin <= 2.3.9 - SQL Injection
The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
raptor
Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...
CVE-2020-29134
TOTVS Fluig 平台 root@kitploit: Fluig 是一款生产力与协作平台，可与 ERP 系统及您公司的其他系统集成，彻底改变您和团队的工作方式。 CVE-2020-29134 root@kitploit: TOTVS Fluig 平台允许通过 base64 编码的参数进行路径遍历。利用此漏洞，可以读取敏感的 XML 文件，这些文件包含访问数据库的数据，在某些情况下还包含 LDAP 连接和 ERP 系统集成的数据。此外，还可以探索系统文件，例如 /etc/passwd 和 /root/.bashhistory。 受影响版本 root@kitploit: -- ==...
CVE-2025-51867
CVE-2025-51867 Vulnerability description Deepfiction AI is an AI entertainment company with a mission to revolutionize personalized storytelling. Deepfiction AI provide a web application to create stories by chatting with LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its ch...
CVE-2023-4800
CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...
CVE-2026-81804
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...
CVE-2026-81804
ZHBackup – Backup, Restore & Migration WordPress plugin versions up to and including 2.4.2 are affected by an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows an attacker to retrieve sensitive data over the network without any prior authentication or user interaction. The CV...
