PT-2026-81333

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.161.19 JFrog Artifactory versions prior to 7.146.36 Description An authenticated user with permissions to read an existing remote Version Control System VCS repository can trigger server-side requests. Thi...

PT-2026-81497

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.2 Description An unauthenticated attacker can retrieve a plaintext password-reset URL via the trp get translations regular AJAX endpoint, enabling the takeover of any administrator account. This issue affec...

UBUNTU-CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

log4j-urlscanner

log4j-detect Einfaches Python 3-Skript zur Erkennung der Sicherheitslücke der Java-Bibliothek "Log4j" CVE-2021-44228 für eine Liste von URLs mit Multithreading Das in Python 3 entwickelte Skript "log4j-detect.py" dient dazu, zu erkennen, ob eine Liste von URLs anfällig für CVE-2021-44228 ist. Daz...

Serein

Serein | Sotto la pioggia del tramonto | Questo progetto è stato sospeso La versione Linux in inglese è online! | Versione inglese per Linux disponibile! http://github.com/W01fh4cker/SereinLinux Dichiarazione | Dichiarazione Questo progetto deve essere utilizzato solo con autorizzazione. È vietat...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ SCHWACHSTELLENDEMONSTRATION ⚠️ JFSA-2025-001495618 - Kritische Befehlseinschleusung in der React Native CLI CVE : CVE-2025-11953 CVSS-Score : 9.8 Kritisch Betroffenes Paket : @react-native-community/cli-server-api Verwundbare Versionen :...

xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover

CVE-2025-59382: QNAP पासवर्ड रीसेट से खाता अधिग्रहण अप्रमाणित हमलावर-नियंत्रित पासवर्ड रीसेट URL /cgi-bin/resetpassword.cgi में है। प्रयोगशाला में QuTScloud c5.2.4.3041 build 20250211 के विरुद्ध परीक्षण किया गया। QNAP ने बाद में इसे सलाह QSA-26-10 में CVE-2025-59382 के रूप में प्रकाशित किया।...

CVE-2024-0352

Abzeichen Lizenz MIT Installation 1. Installieren Sie Python3 und pip Anleitung hier Wenn Sie das nicht verstehen, sollten Sie dieses Tool eigentlich nicht verwenden Installieren über pip root@kitploit: pip install CVE-2024-0352 Führen Sie den folgenden Befehl aus, um zu prüfen CVE-2024-0352 -h...

CVE-2024-0195

Badge Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capirlo, non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install CVE-2024-0195 Esegui il comando qui sotto per verificare CVE-2024-0195 -h Configurazioni 2. Abbiamo integrato l'API...

CVE-2021-24917

Badges Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capire, non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install CVE-2021-24917 Esegui il comando qui sotto per verificare CVE-2021-24917 -h Configurazioni 2. Abbiamo integrato l'A...

CVE-2020-3452

Badge Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capirlo, probabilmente non dovresti usarlo Installa tramite pip root@kitploit: pip install CVE-2020-3452 Esegui il comando qui sotto per verificare CVE-2020-3452 -h Configurazioni 2. Abbiamo integrato con l'A...

CVE-2015-1635

Badges Licença MIT Instalação 1. Instale o Python3 e o pip Instruções Aqui Se você não conseguir fazer isso, não deveria estar usando esta ferramenta Instale via pip root@kitploit: pip install CVE-2015-1635 Execute o comando abaixo para verificar CVE-2015-1635 -h Configurações 2. Integramos com a...

CVE-2000-0114

Badge Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capire questo, probabilmente non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install CVE-2000-0114 Esegui il comando qui sotto per verificare CVE-2000-0114 -h Configurazioni 2...

CVE-2026-76838

Hi.Events (an open-source event management platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook handling. The NoInternalUrlRule validates a webhook destination using gethostbyname() only at registration time , but the WebhookDispatchService never revalidates ...

Malicious code in poly-price-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...

gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL

A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...

awx: webhook status callback SSRF leaks the Git PAT

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

CVE-2023-30777

CVE-2023-30777 Generatore di URL Proof of Concept PoC per una vulnerabilità XSS riflessa nel plugin Advanced Custom Fields di WordPress. PoC generato da: Alucard0x1 Crediti dell'exploit: https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...