2506 matches found
CVE-2026-81648
The CryptoPayment Gateway WordPress plugin (versions 1.2.1–1.2.2 ) contains a missing authorization check on an AJAX endpoint , allowing unauthenticated users to invoke administrative operations. Attackers can delete arbitrary files on the server, overwrite the payment gateway configuration , and...
CVE-2023-28432
CVE-2023-28432 CVE-2023-28432 Exploit de Divulgación de Información de Minio Uso Escriba la url en urls.txt y ejecute python CVE-2023-28432.py directamente Formato compatible: http://ip:puerto, ip:puerto root@kitploit: python CVE-2023-28432.py ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████...
CVE-2023-28432
Explotación de vulnerabilidad en MinIO CVE-2023-28432 Descripción Este script en python3 está diseñado para explotar CVE-2023-28432, que potencialmente afecta a ciertas configuraciones del servidor MinIO. El script realiza una solicitud POST a un hostname especificado, intentando recuperar...
CVE-2024-0368
CVE-2024-0368 El plugin Hustle = 7.8.3 contiene credenciales de la API de HubSpot codificadas en inc/providers/hubspot/hustle-hubspot-api.php Resumen de la vulnerabilidad...
CVE-2025-51643
CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...
CVE-2024-41290
CVE-2024-41290 发现 FlatPress CMS v1.3.1 1.3 使用不安全的方法存储认证数据 附加信息： FlatPress CMS 1.3.1 版本将包括用户名和密码哈希在内的认证相关数据不安全地直接存储在客户端 Cookie 中。这种做法使敏感信息面临攻击者未经授权访问和篡改的风险。 产品厂商： 在 Cookie 中不安全地存储认证数据 受影响产品代码库： FlatPress CMS version 1.3.1 - 1.3 受影响组件： Cookie 影响： 用户名和密码哈希暴露在客户端 Cookie 中，可能被未经授权方访问或修改。 如果攻击者获得这些...
CVE-2018-9995_dvr_credentials
Tool show DVR Credentiales root@kitploit: Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa Exploit: root@kitploit: $ curl...
CVE-2025-45620
Issue details Camera model PTC310UV2 running firmware version 0.1.0000.59. The vulnerability is found in the web interface that is used to access the camera. The vulnerability was found during a penetration test, thus, certain information in the PoC screenshots have been redacted. Description Thi...
CVE-2026-80494
The Yogeta WP Cloud WordPress plugin (through version 1.0) contains an unauthenticated arbitrary file download vulnerability. A public endpoint fails to validate a user-supplied file path before passing it to a file-read function, and the endpoint requires no authorization. This allows any unauth...
EUVD-2026-76778
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials...
CVE-2025-25968
CVE-2025-25968: Vulnerabilidad de Control de Acceso Inadecuado en DDSN Interactive cm3 Acora CMS versión 10.1.1 DDSN Interactive cm3 Acora CMS versión 10.1.1 contiene una vulnerabilidad de control de acceso inadecuado. Un usuario con privilegios de editor puede acceder a información sensible, com...
CVE-2025-24071
CVE-2025-24071 Este script de Python está diseñado para demostrar la vulnerabilidad CVE-2025-24071 en el Explorador de Windows. Esta vulnerabilidad permite a un atacante capturar credenciales netNTLMv2 de una víctima sin ninguna interacción directa de la misma. Descripción La vulnerabilidad...
Linux Distros Unpatched Vulnerability : CVE-2026-90461
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
tryhackme-moniker-link
tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 — TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...
CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...
UBUNTU-CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...
CVE-2025-50110
CVE-2025-50110 Transmisión de información sensible en texto claro en la aplicación Android EagleEyes Lite 1. Resumen Nombre : EagleEyesLite Versión : 2.0.0 Proveedor : AVTECH CWE : CWE-319: Transmisión de información sensible en texto claro, CWE-598: Uso del método de solicitud GET con cadenas de...
CVE-2026-90457
CVE-2026-90457 involves an inconsistency in administrative password hashing across authentication paths in an ICS product (per CISA advisory ICSA-26-254-01). One path uses a weak, fast hashing algorithm , and the resulting hash file is written with permissions readable by any local user . A separ...
CVE-2026-90460
OpenStack Keystone before 29.0.3 has an authorization flaw in the /v3/credentials API . Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not prevented from creating, modifying, or deleting credentials. EC2-derive...