Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

159937 matches found

Kitploit
Kitploit•added 2026/09/28 11:33 p.m.•13 views

CVE-2025-59528

Version française CVE-2025-59528 개념 증명 Proof of Concept 승인된 환경에서 취약점의 기술적 검증에 초점을 맞춘 최소 PoC입니다. 사전 요구 사항 대상 Flowise 대시보드에 사용자 계정이 있어야 합니다. 해당 계정에 연결된 유효한 API 키가 있어야 합니다. PoC를 실행하기 전에 콜백 호스트에서 리스너를 시작해야 합니다 예: nc -lvn 4444. 사용 예시 먼저 리스너를 시작합니다: nc -lvn 4444 python3 poc.py --domain example.com --ho...

10CVSS7.9AI score0.86218EPSS
SaveExploits24References1
Kitploit
Kitploit•added 2026/09/28 10:44 p.m.•13 views

CVE-2025-2304-POC

CVE-2025-2304 Camaleon CMS 2.9.1未満における権限昇格 説明 updatedajaxメソッドにおける大量代入の脆弱性により、認証済みユーザーがパスワード変更時にpasswordrole=adminパラメータを注入して管理者権限に昇格できます。 使用方法 python3 exploit.py 使用例 python3 exploit.py http://target.com attacker attacker 攻撃成功後、ログアウトして再度ログインすると管理者権限が取得できます。 参考文献...

9.4CVSS6.3AI score0.00616EPSS
SaveExploits17References1
NVD
NVD•added 2026/09/28 10:17 p.m.•10 views

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

7.1CVSS0.0037EPSS
SaveExploits0References8
Cvelist
Cvelist•added 2026/09/28 10:00 p.m.•32 views

CVE-2026-102297 ZoneMinder before 1.38.4 Incorrect Authorization in frames API index

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

5.3CVSS0.00222EPSS
SaveExploits0References7
Cvelist
Cvelist•added 2026/09/28 10:00 p.m.•27 views

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

5.4CVSS0.00124EPSS
SaveExploits0References5
Cvelist
Cvelist•added 2026/09/28 10:00 p.m.•28 views

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

7.1CVSS0.0037EPSS
SaveExploits0References8
Debian CVE
Debian CVE•added 2026/09/28 10:00 p.m.•5 views

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

7.1CVSS6AI score0.0037EPSS
SaveExploits0
Kitploit
Kitploit•added 2026/09/28 9:20 p.m.•12 views

CVE-2020-25042-PoC

CVE-2020-25042-PoC Mara CMS 7.5에서 원격 코드 실행으로 이어질 수 있는 인증된 임의 파일 업로드 취약점인 CVE-2020-25042에 대한 개념 증명PoC입니다. 이 스크립트는 유효한 Mara CMS 관리자/매니저 계정으로 로그인하고, codebase/handler.php를 통해 PHP 페이로드를 업로드한 뒤 업로드된 파일을 통해 명령어를 실행합니다. 또한 가능하면 기존 셸을 재사용하므로 실행할 때마다 새 PHP 파일을 만들지 않습니다. 동작 방식 1. 예상된 셸이 이미 존재하고 재사용 가능한지...

7.2CVSS8AI score0.18248EPSS
SaveExploits4
OSV
OSV•added 2026/09/28 9:17 p.m.•5 views

DEBIAN-CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

7.4CVSS5.9AI score0.00185EPSS
SaveExploits0References1
NVD
NVD•added 2026/09/28 9:17 p.m.•15 views

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

7.4CVSS0.00175EPSS
SaveExploits0References3
OSV
OSV•added 2026/09/28 9:17 p.m.•4 views

DEBIAN-CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

7.4CVSS6.1AI score0.00175EPSS
SaveExploits0References1
OSV
OSV•added 2026/09/28 9:17 p.m.•4 views

AZL-105239 CVE-2026-102266 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

7.4CVSS6.1AI score0.00175EPSS
SaveExploits0References1
NVD
NVD•added 2026/09/28 9:17 p.m.•13 views

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

7.4CVSS0.00175EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve•added 2026/09/28 9:17 p.m.•6 views

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

7.4CVSS5.9AI score0.00175EPSS
SaveExploits0References4
OSV
OSV•added 2026/09/28 9:17 p.m.•7 views

UBUNTU-CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

7.4CVSS6.1AI score0.00175EPSS
SaveExploits0References5
Kitploit
Kitploit•added 2026/09/28 9:11 p.m.•16 views

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x 인증된 RCE - TinyMCE를 통한 제한 없는 PHP 파일 업로드 설명 CVE-2026-38526은 Webkul Krayin CRM v2.2.x에 영향을 미치는 중요한 인증된 원격 코드 실행 취약점입니다. 이 취약점은 업로드된 파일 유형을 검증하지 못하는 TinyMCE 미디어 업로드 엔드포인트 /admin/tinymce/upload에 존재합니다. 인증된 공격자는 악성 PHP 파일을 업로드하고 서버에서 임의의 명령을 실행할 수 있습니다. CVE:...

9.9CVSS6.3AI score0.02353EPSS
SaveExploits16References1
Kitploit
Kitploit•added 2026/09/28 8:59 p.m.•13 views

CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC

CVE-2026-38751 – OpenSTAManager 임의 파일 업로드 PoC 이 저장소는 OpenSTAManager ≤ 2.10에 영향을 미치는 CVE-2026-38751에 대한 개념 증명PoC 익스플로잇을 포함합니다. 이 취약점은 인증된 공격자가 모듈 업데이트 기능을 통해 악성 모듈을 업로드하여 임의 파일 업로드 및 원격 코드 실행RCE을 유발할 수 있게 합니다. CVE 참조 MITRE CVE 항목최초 공개 기록: https://vulners.com/cve/CVE-2026-38751 NVDNIST 취약점 데이터베이스:...

7.2CVSS6.3AI score0.00529EPSS
SaveExploits5References2
Kitploit
Kitploit•added 2026/09/28 8:41 p.m.•17 views

CVE-2026-67206

CVE-2026-67206 - Wolf CMS -u -p python exploit.py http://127.0.0.1:8080/ -u admin -p admin 예시 └─$ python exploit.py http://127.0.0.1:8080/ -u admin -p 12966cc814K 제공된 자격 증명으로 로그인 중... + 로그인 성공 shell.php라는 파일 생성 중... + 파일 생성 성공 shell.php에 페이로드 작성 시도 중... + 페이로드 작성 성공! + 웹 셸은...

8.8CVSS6.2AI score0.02132EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment•added 2026/09/28 8:38 p.m.•7 views

CVE-2026-102273 PyJWT accepts public JWK containers as HMAC secrets

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

7.4CVSS6AI score0.00175EPSS
SaveExploits0References3
Debian CVE
Debian CVE•added 2026/09/28 8:36 p.m.•10 views

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

7.4CVSS5.9AI score0.00185EPSS
SaveExploits0
Rows per page
Query Builder