CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

EUVD-2026-65339

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137

CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...

CVE-2026-10582

A flaw was found in Hugo. The security.http.urls allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hu...

CVE-2026-20841

🛡️ CVE-2026-20841 - Strumento di Test di Sicurezza per Windows Notepad ⚠️ Cos'è CVE-2026-20841? CVE-2026-20841 è una debolezza di sicurezza nota nell'applicazione Windows Notepad. Riguarda la funzionalità markdown, che permette a Notepad di visualizzare testo formattato con link cliccabili. Questa...

CVE-2023-41425

CVE-2023-41425 Ne scrivo uno perché quello che ho trovato non funziona Utilizzo root@kitploit: python3 exploit.py http://example.com/loginURL 10.10.xx.xx 9001...

crawpy

Crawpy Yet another content discovery tool written in python. What makes this tool different than others: Sends asynchronous HTTP requests, fast Calibration mode, applies filters on its own Recursive scan mode with additional flags Report generation, you can later go and check your results Multipl...

CVE-2024-4956

CVE-2024-4956 - Path Traversal non autenticato in Nexus Repository Manager 3 Nexus Repository Manager è un gestore di repository che organizza, memorizza e distribuisce gli artefatti necessari per lo sviluppo. È stata scoperta una vulnerabilità di path traversal in Nexus Repository 3, nelle...

CVE-2020-12696

CVE-2020-12696 root@kitploit: ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress...

CVE-2024-50961

Esposizione di Dati Sensibili CVE-2024-50961 Descrizione In DonWeb Ferozo Hosting v1.1, un attaccante remoto può sfruttare i parametri URL per accedere a dati sensibili, incluse le credenziali del database. I vettori d'attacco includono l'intercettazione di rete, i log del server e la cronologia...

CVE-2024-4956

CVE-2024-4956 - Path Traversal non autenticato in Nexus Repository Manager 3 Nexus Repository Manager è un repository manager che organizza, archivia e distribuisce gli artefatti necessari allo sviluppo. È stata scoperta una vulnerabilità di path traversal in Nexus Repository 3, nelle versioni...

CVE-2024-0235

Badge Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capirlo, non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install CVE-2024-0235 Esegui il comando seguente per verificare CVE-2024-0235 -h Configurazioni 2. Abbiamo integrato l'API ...

CVE-2019-9670

Badge Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni Qui Se non riesci a capirlo, non dovresti davvero usare questo strumento Installa tramite pip root@kitploit: pip install CVE-2019-9670 Esegui il comando qui sotto per verificare CVE-2019-9670 -h Configurazioni 2. Abbiamo integra...

CVE-2024-31819

Instalação e Execução do script 💻 Pré-requisitos Antes de começar, certifique-se de que você tem as seguintes ferramentas instaladas na sua máquina: Python 3.x Git pip para gerenciar as dependências Python Etapas de Instalação 1. Clonar o repositório Use git para clonar o repositório:...

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

Docassemble - Local File Inclusion

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...