CVE-2025-70829

CVE-2025-70829: Esposizione di Informazioni in Datart Documento in Cinese 1. Panoramica della Vulnerabilità CVE ID : CVE-2025-70829 Prodotto : Datart Versione : v1.0.0-rc.3 Tipo di Vulnerabilità : Esposizione di Informazioni Una vulnerabilità di esposizione di informazioni in Datart v1.0.0-rc.3...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance = 1.4.2 - Esposizione Non Autenticata di Informazioni Sensibili fino all'Escalation dei Privilegi/Compromissione dell'Account cPanel 🚨 TNC Toolbox: Web Performance = 1.4.2 - Esposizione Non Autenticata di Informazioni Sensibili fino all'Escalation dei...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

HTB-Devvortex-CVE-2023-2375-PoC

جوملا! CVE-2023-23752 - إثبات المفهوم لكشف معلومات غير مصادق عليه الوصف يحتوي هذا المستودع على إثبات المفهوم PoC لاستغلال CVE-2023-23752، وهي ثغرة في جوملا! تسمح بكشف معلومات بدون مصادقة. يمكن لهذه الثغرة كشف معلومات حساسة، بما في ذلك بيانات اعتماد قاعدة البيانات وملفات التكوين وغيرها، للمستخدمين...

CVE-2026-13714

CVE-2026-13714 Plugin Realtyna Organic IDX + WPL Real Estate 5.3.0 - Caricamento arbitrario di file non autenticato che consente l'esecuzione di codice remoto CVE-2026-13714 — RCE non autenticata in WPL Real Estate Plugin Realtyna Organic IDX + WPL Real Estate per WordPress 5.3.0 Caricamento...

PT-2026-79833

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter è uno strumento Python avanzato progettato per i ricercatori di sicurezza al fine di automatizzare il rilevamento di segreti hardcoded nel JavaScript lato client. A differenza dei semplici scanner, V2 include un crawler dinamico che analizza l'HTML del...

gerapy-cve-2021-43857

Gerapy CVE-2021-43857 RCE autenticata Questo repository contiene un proof of concept per CVE-2021-43857 , una vulnerabilità di esecuzione di codice in remoto che affligge Gerapy -p -L -P Requisiti 1. Python 3.x 2. requests e pyfiglet pip install requests pyfiglet 3. Netcat nc...

CVE-2026-78062

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

EUVD-2026-64631

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

CVE-2026-78062

CVE-2026-78062 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability resides in the JWT Secret Handler component, specifically the envSchema.parse function in lib/config.ts. Manipulation of the BETTER_AUTH_SECRET argument results in hard-coded credentials , enabling remote unauthenticat...

CVE-2026-78062 vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

CVE-2023-37073

CVE-2023-37073 Le credenziali predefinite di Telnet possono causare divulgazione di informazioni e attacchi denial-of-service DoS. Passaggi per riprodurre Questo riguarda l'AP AR-5310 root@kitploit: Telnet 192.168.1.1 username:user password:user Then Boom ... You logged in Divulgazione di...

aziot-cctv-cve-2025-50777

aziot-cctv-cve-2025-50777 CVE-2025-50777: Accesso root ed esposizione di credenziali in chiaro in AZIOT Smart CCTV Riepilogo È stata identificata una vulnerabilità nel controllo degli accessi locali CVE-2025-50777 nel firmware della AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera versione...

AWSome-Pentesting

Cheatsheet di Pentesting AWSome Le pull request sono apprezzate : Questa guida è stata creata per aiutare i pentester a imparare di più sulle misconfigurazioni AWS e sui modi per abusarne. È stata creata con i miei appunti raccolti dopo innumerevoli ore di studio e annotazioni provenienti da vari...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability in the Settings resource. The read policy uses an always-allow authorization check that bypasses all identity verification, allowing unauthenticated attackers to send a GET request to the settings API endpoint with a valid reco...

EUVD-2026-64068

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

Silent-Call

Silent;Call Raiz remota pré-autenticação no Cisco Unified Communications Manager 15.x Três solicitações HTTP. Zero credenciais. Acesso root. Todas as chamadas agora são suas. Cadeia de Ataque Etapa| Componente| Descrição ---|---|--- 1| Spoofhack| Spoofing do cabeçalho X-Forwarded-For contorna a...

Exploits

Exploits Exploit-POCs für reale Welt und CTFs. Reale Welt CVE| Kurzbeschreibung| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL-Injection| POC CVE-2018-8880| Nicht authentifizierte Exfiltration von Netzwerkinformationen des Lutron Quantum Bacnet v2| POC CVE-2018-11629| Standard- und nicht...