CVE-2026-73714

CVE-2026-73714 is an authenticated sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer . An authenticated low-privilege operator user can access data beyond what their existing privilege level authorizes, potentially leading to further unauthorized access. ...

CVE-2024-54819

CVE-2024-54819 자세한 내용은 다음에서 확인하세요: https://www.partywave.site about CVE-2024-54819 로그인 POST 요청 공격자는 로그인 상태여야 합니다. root@kitploit: POST /librarian/index.php/authentication HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:128.0 Gecko/20100101 Firefox/128.0 removed...

CVE-2021-40870

CVE-2021-40870 Aviatrix permet à un utilisateur authentifié d'exécuter du code arbitraire...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69575

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69557

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

libssh: libssh: denial of service via oversized SFTP read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2020-14295

CVE-2020-14295 Preuve de concept de CVE-2020-14295. L'article original se trouve sur exploit-db. Installer les dépendances root@kitploit: python3 -m pip install -r requirements.txt Utilisation root@kitploit: $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti...

CVE-2016-5734-docker

CVE-2016-5734-docker Уязвимость удаленного выполнения кода в PhpMyAdmin 4.0.x—4.6.2 CVE-2016-5734 Установка root@kitploit: git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 Эксплуатация root@kitploit: python3...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

EUVD-2026-69295

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

EUVD-2026-69292

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-79686

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. The Dell-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicat...

CVE-2026-79684

Dell PowerStore contains a Protection Mechanism Failure vulnerability (CVE-2026-79684, CVSS 3.1 score 8.8 HIGH ). An authenticated user with limited privileges could bypass access restrictions to gain escalated privileges , with high impact on confidentiality, integrity, and availability over the...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 версии ниже 11.3.757 уязвим к сохранённой HTML-инъекции в панели администратора CrushFTP Отчёты / «Кто создал папку», что позволяет выполнять постоянный HTML-код в сессиях администраторов. CWE CWE-79 — Неправильная нейтрализация входных данных при генерации веб-страниц...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 Обзор Этот репозиторий содержит образовательный исследовательский проект в области безопасности , посвящённый CVE-2025-68613 — уязвимости, затрагивающей определённые версии n8n , связанной с небезопасным вычислением выражений рабочих процессов. Проект тестировался только в...

CVE-2025-40677

Exploit Title: Summar Employee Portal до версии 3.98.0 Аутентифицированное SQL-инъекция - CVE-2025-40677 Google Dork: inurl:"/MemberPages/quienesquien.aspx" Дата: 09/22/2025 Автор эксплойта: Peter Gabaldon - https://pgj11.com/ Домашняя страница вендора: https://www.summar.es/ Ссылка на ПО:...