Lucene search
+L

7251 matches found

Kitploit
Kitploit
added 2026/08/25 5:59 p.m.1 views

cve-2023-5217-poc

CVE-2023-5217: Desbordamiento de Montón en Codificación VP8 de libvpx PoC CVE-2023-5217 es una vulnerabilidad de libvpx explotada in-the-wild que fue encontrada por Clément Lecigne del Grupo de Análisis de Amenazas de Google para estar atacando Chrome. Este repositorio muestra cómo desencadenar...

8.8CVSS8.6AI score0.49013EPSS
SaveExploits3References4
Kitploit
Kitploit
added 2026/08/25 4:11 p.m.1 views

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Ejecución remota de código de nombres locales proporcionados por el usuario en Rails Ejecución remota de código de nombres locales proporcionados por el usuario en Rails 5.0.1 Había una vulnerabilidad en versiones de Rails anteriores a la 5.0.1 que permitiría a un...

8.8CVSS6.1AI score0.82047EPSS
SaveExploits10
EUVD
EUVD
added 2026/08/25 1:08 p.m.4 views

EUVD-2026-65489

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

4.2CVSS5.2AI score
SaveExploits0References1
CVE
CVE
added 2026/08/25 1:08 p.m.11 views

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

4.2CVSS5.3AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/25 1:08 p.m.8 views

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

4.2CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/25 12:45 p.m.1 views

CVE-2025-68664

CVE-2025-68664 Todo lo que quiero para Navidad son tus secretos: LangGrinch golpea el núcleo de LangChain CVE-2025-68664 Autor: Yarden Porat Investigación de Cyata: Vulnerabilidad LangGrinch en LangChain Publicado: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Ayer, LangChain...

9.3CVSS8.2AI score0.43415EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/08/25 7:35 a.m.1 views

cve-2025-5548-freefloat-ftp-walkthrough

CVE-2025-5548 – FreeFloat FTP Server 1.0 Walkthrough Repositorio donde documentamos paso a paso el análisis y la explotación controlada de la CVE-2025-5548 en FreeFloat FTP Server 1.0 dentro de un entorno de laboratorio. En este proyecto no nos limitamos a ejecutar un exploit ya preparado. Nuestr...

9.8CVSS7.3AI score0.124EPSS
SaveExploits13
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.87 views

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. id: CVE-2021-24215...

10CVSS8.7AI score0.09733EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.119 views

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

9.8CVSS8.5AI score0.71725EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/08/25 5:23 a.m.17 views

peer-tweet

PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...

5.8AI score
SaveExploits0References11
Kitploit
Kitploit
added 2026/08/25 4:27 a.m.1 views

apple-positional-audio-codec-invalid-header

Prueba de concepto para el parche de CoreAudio CVE-2025-31200 en iOS 18.4.1. Artículo aquí https://blog.noahhw.dev/posts/cve-2025-31200/. Actualización 27/05/2025 He logrado llevar esto a una escritura controlada , aunque no arbitraria. El artículo está por venir. Sin embargo, para comprobarlo po...

9.8CVSS0.1966EPSS
SaveExploits5References1
NVD
NVD
added 2026/08/24 9:17 p.m.11 views

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

8.2CVSS
SaveExploits0References5
CVE
CVE
added 2026/08/24 8:33 p.m.9 views

CVE-2026-77634

CakePHP , a PHP rapid development framework, is affected by a CRLF header injection vulnerability in its mail transport layer. Custom mail headers added via Message::setHeaders() or Message::addHeaders() do not strip CRLF bytes, allowing an attacker to inject arbitrary headers when user-controlle...

8.2CVSS5.4AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/24 8:30 p.m.33 views

CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

9.2CVSS
SaveExploits0References7
CVE
CVE
added 2026/08/24 12:49 p.m.10 views

CVE-2026-78365

Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 are affected by an IDOR (Insecure Direct Object Reference) in the supplier API . A missing authorization check on the company_id field allows any authenticated user to send a PUT request to /api/supplier/{id} and set company_id in the body, en...

9.3CVSS5.2AI score
SaveExploits0References3
EUVD
EUVD
added 2026/08/24 12:49 p.m.6 views

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS5.3AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/24 12:49 p.m.33 views

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS
SaveExploits0References3
NVD
NVD
added 2026/08/21 1:18 p.m.9 views

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS0.00253EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/21 12:12 p.m.10 views

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS5.4AI score0.00253EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/21 11:29 a.m.27 views

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

8.7CVSS0.0032EPSS
SaveExploits0References3
Rows per page
Query Builder