Lucene search
+L

11497 matches found

Nuclei
Nuclei
added 2026/09/02 7:49 a.m.29 views

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files. id: CVE-2019-25246 info: name: BEWARD...

8.8CVSS5.9AI score0.18903EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.25 views

Images to WebP < 1.9 - Authenticated Local File Inclusion

The Images to WebP WordPress plugin before version 1.9 did not validate or sanitize the tab parameter before using it in the include function. id: CVE-2021-24644 info: name: Images to WebP 1.9 - Authenticated Local File Inclusion author: Sourabh-Sahu severity: high description: | The Images to We...

7.5CVSS7.1AI score0.05028EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.39 views

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

6.4CVSS6AI score0.00611EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.32 views

AstrBot <= 4.22.1 - Command Injection

AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any...

6.5CVSS6.9AI score0.02304EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.62 views

Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

8.7CVSS5.9AI score0.01279EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/02 7:41 a.m.6 views

CVE-2026-33229

CVE-2026-33229 — Apache Velocity サンドボックス回避による XWiki RCE XWiki Platform におけるリモートコード実行の脆弱性です。スクリプト権限を持つ認証済みユーザーが、Velocity コンテキスト内に既に存在する事前インスタンス化されたオブジェクトを走査することで、Java Reflection を一切必要とせずに Apache Velocity サンドボックスを完全に回避できます。 📄 完全な技術詳細: youssefazefzaf.com/posts/cve 詳細...

9.8CVSS7.2AI score0.0054EPSS
SaveExploits1
EUVD
EUVD
added 2026/09/02 6:00 a.m.7 views

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

3.8CVSS5.9AI score0.00132EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/02 5:46 a.m.5 views

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - Local File Inclusion 설명 : Customer Support System 1.0은 Local File Inclusion 취약점에 취약합니다. 인증된 사용자는 래퍼 필터를 통해 Local File Inclusion LFI 취약점을 악용하여 운영 체제의 PHP 파일에 접근하고 읽을 수 있습니다. 취약한 제품 버전 : Customer Support System 1.0 CVE 저자 : Geraldo Alcântara 날짜 :...

4.9CVSS5.9AI score0.00766EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 4:35 a.m.2 views

AgentDVR-5.1.6.0-File-Upload-and-Remote-Code-Execution

AgentDVR-5.1.6.0-File-Upload-and-Remote-Code-Execution CVE-2024-22515 任意ファイルアップロードおよび CVE-2024-22514 リモートコード実行 AgentDVR 5.1.6.0、認証済み (古いバージョンも影響を受ける可能性があります) https://github.com/Orange-418/CVE-2024-22514-Remote-Code-Execution https://github.com/Orange-418/CVE-2024-22515-File-Upload-Vulnerability...

8.8CVSS7.2AI score0.01401EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/02 4:04 a.m.4 views

CVE-2021-31630-OpenPLC_RCE

CVE-2021-31630-OpenPLCRCE OpenPLC v3 웹서버에서의 인증된 원격 코드 실행 익스플로잇...

9CVSS7.2AI score0.27075EPSS
SaveExploits10
Kitploit
Kitploit
added 2026/09/02 3:22 a.m.4 views

CVE-2022-24715

Icinga Web 2 - 인증된 원격 코드 실행 2.8.6, 2.9.6, 2.10 원격 명령 실행 리버스 셸 사용법 root@kitploit: usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL http://ipvictima -U USER, --user USER Insert user -U user -P...

8.8CVSS7.2AI score0.1467EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/02 2:54 a.m.3 views

CVE-2025-45250

CVE-2025-45250 推奨される説明 root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent:...

5.5CVSS5.9AI score0.0028EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 2:42 a.m.8 views

CVE-2024-50803-Redaxo

CVE-2024-50803 Redaxoのmediapool機能におけるStored XSS Redaxo 5.18.0より前のバージョンに、保存型クロスサイトスクリプティング(XSS)の脆弱性が見つかりました。十分な権限を持つ攻撃者がmediapool機能を通じて悪意のあるSVGファイルをアップロードできる可能性があります。 関連記事を公開 : https://medium.com/@praison66/5d15a3cd054d 発見者 : Praison (2024年9月) 参考 : https://vulners.com/cve/CVE-2024-50803...

5.4CVSS5.9AI score0.00536EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/02 2:31 a.m.3 views

CVE-2024-34716

CVE-2024-34716PoC 詳細な技術情報は https://ayoubmokhtar.com/post/pngdrivenchainxsstoremotecodeexecutionprestashop8.1.5cve-2024-34716/ で確認できます。 インストール pip install -r requirements.txt 使い方 Usage: python exploit.py --url --email --local-ip --admin-path...

9.6CVSS7.2AI score0.5617EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/02 2:17 a.m.3 views

CVE-2024-35584

CVE-2024-35584 OpenSIS 認証済みSQLインジェクション 説明 Ajax.php、ForWindow.php、ForExport.php、Modules.php、functions/HackingLogFnc.php にSQLインジェクションの脆弱性が存在します。この問題は OpenSis Community Edition 9.1 から 8.0 に影響し、それ以前のバージョンにも影響する可能性があります。 概念実証 例の1つである Ajax.php では、悪意のあるアクティビティが検出された場合、IP...

8.8CVSS5.9AI score0.05857EPSS
SaveExploits2
CVE
CVE
added 2026/09/02 1:18 a.m.10 views

CVE-2026-84715

FeatherPanel versions before 1.3.7.10 contain a privilege escalation vulnerability in the SubuserController updateSubuser handler. The handler fails to properly validate permissions, allowing an authenticated subuser with minimal access to send a crafted request that modifies their own permission...

8.8CVSS5.9AI score0.00319EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/01 10:49 p.m.4 views

CVE-2022-1388-Exploit-POC

CVE-2022-1388 エクスプロイト POC F5 BIG IP root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: REDACTED:8083 Content-Length: 45 Connection: Keep-Alive,X-F5-Auth-Token Cache-Control: max-age=0 X-F5-Auth-Token: SherlockSecure Content-Type: application/json Authorization: Basic YWRtaW46aG9yaXpvbjM=...

9.8CVSS7.4AI score0.99958EPSS
SaveExploits63
Kitploit
Kitploit
added 2026/09/01 10:05 p.m.4 views

CVE-2024-57785

CVE-2024-57785 root@kitploit: Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional...

4.9CVSS5.4AI score0.00683EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/01 9:54 p.m.5 views

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OSコマンドインジェクション n-day調査レポート&PoC — CVSS 7.1のOSコマンドインジェクション脆弱性(AXIS VAPIX Media Clip API)に対するパッチ適用後の技術分析。Axisデバイスに対するブラックボックステストを通じて独自に再発見・検証されたものです。...

8.8CVSS6.5AI score0.00499EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/01 9:45 p.m.5 views

CVE-2024-9264

CVE-2024-9264 root@kitploit: python CVE-2024-9264.py '' -u '' -p '' -c ''...

9.9CVSS6.3AI score0.94864EPSS
SaveExploits11
Rows per page
Query Builder