CVE-2026-72578

CVE-2026-72578 concerns FreePBX Framework 17.0. The vulnerability is a CSRF weakness in the /admin/ajax.php dispatcher (amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php) where no CSRF tokens are implemented; protection relies solely on a Referer header, which can be bypassed when no Referer hea...

CVE-2026-72578 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

org.apache.ranger:security-admin-web (>=2.5.0, <=2.8.0) potentially affected by CVE-2026-40920 via org.apache.ranger:ranger-authn (>=2.5.0, <=2.8.0)

org.apache.ranger:ranger-authn MAVEN version =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2026-40920 Source advisory: MEND:CVE-2026-40920...

org.apache.ranger:security-admin-web (>=2.5.0, <=2.8.0) potentially affected by CVE-2026-65945 via org.apache.ranger:ranger-authn (>=2.5.0, <=2.8.0)

org.apache.ranger:ranger-authn MAVEN version =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2026-65945 Source advisory: MEND:CVE-2026-65945...

GHSA-vwf4-m7j8-wcjf

GHSA-vwf4-m7j8-wcjf — Metabase Pre-Auth SQL Injection Unaut...

Metabase-Exploit

Metabase SQL Injection Zero-Day Exploit GHSA-vwf4-m7j8-wcjf...

xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

EUVD-2026-55113

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-16299

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16298

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-13600

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-13701

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

coturn - Web Admin Auth Bypass Detection (CVE-2018-4056)

Detects CVE-2018-4056 by POSTing a UNION SELECT login payload to /logon and looking for Set Admin Session Realm after priming /favicon.ico. !/usr/bin/env python3 -- coding: utf-8 -- """coturn web admin SQLi authentication bypass CVE-2018-4056.""" from kittysploit import from...

PineApp Mail-SeCure - test_li_connection.php RCE Detection

Detects PineApp Mail-SeCure RCE via /admin/testliconnection.php?iptest=127.0.0.1;id. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FreePBX - Music Upload Filename RCE

Exploits FreePBX music module by injecting shell into multipart filename $CMD.wav on /admin/ajax.php?module=music&command=upload. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename RCE — opens execute session.""" import re from kittysploit import from...

Apache ActiveMQ - Double-Slash Source Disclosure Detection (CVE-2010-1587)

Detects CVE-2010-1587 by requesting //admin/queues.jsp and matching the raw JSP expression $sessionScope"secret" in the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-1587 by requesting //admin/queues.""" import re from kittysploit import from...