CVE-2019-10708

Scms - Inyección SQL exploit.py es un PoC para la vulnerabilidad CVE-2019-10708, implementa multiprocessing para inyección, obtiene nombres de base de datos y credenciales de administrador del backend se recomienda la versión anterior al 20190401 Uso root@kitploit: 測試是否可注入 python3 exploit.py...

CVE-2024-21413-POC

CVE-2024-21413 - POC Uso: python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf !NOTE r00tb1t : es el archivo de prueba compartido word en este caso desde la máquina del atacante...

CVE-2024-43451-POC

Descripción Nombre : CVE-2024-43451 Puntuación CVSSv3 : 6.5 Versiones afectadas : Todas las versiones de Microsoft Windows anteriores al parche de noviembre de 2024 CVE-2024-43451 es una vulnerabilidad de día cero en Microsoft Windows que permite a los atacantes capturar hashes de contraseñas...

CVE-2021-21975

CVE-2021-21975 Falsificación de solicitudes del lado del servidor SSRF en la API de VMware vRealize Operations Manager vRealize Operations vROps es una herramienta de gestión autónoma de operaciones de TI impulsada por IA, desde aplicaciones hasta infraestructura, para optimizar, planificar y...

CVE-2026-81913

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by multiple vulnerabilities: - An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously...

CVE-2026-3096

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-3096

CVE-2026-3096 affects multiple WSO2 products whose web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page , enabling a reverse tabnabbing attack. An attacker can manipulate the trusted applicati...

EUVD-2026-75731

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-3096 Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-89011

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-88937

knowns through version 0.33.0 is affected by a path traversal vulnerability in its code generation template engine (internal/codegen/template_engine.go). The engine fails to properly validate template destination paths, allowing an attacker who supplies a malicious template to read and write arbi...

EUVD-2026-75086

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

CVE-2026-84197

Eclipse Ditto's Node.js JavaScript client hard-codes rejectUnauthorized: false in its WebSocket transport, disabling TLS certificate chain and hostname validation for every wss:// connection. All released versions of @eclipse-ditto/ditto-javascript-client-node (2.0.0–3.9.0) and its predecessor @e...