Lucene search
+L

352371 matches found

Kitploit
Kitploit
•added 2026/09/25 2:47 a.m.•13 views

osintbuddy

I have no data yet. It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts. | plugins-system | osintbuddy.com | osintbuddy discord | entities | pypi package | Introducing OSINTBuddy Notice - No, this projec...

5.8AI score
SaveExploits0References9
Kitploit
Kitploit
•added 2026/09/25 2:44 a.m.•17 views

ShimMe

ShimMe Herramientas de la charla DEFCON 32 "SHIM me what you got - Manipulando Shim y Office para inyección de código" Office Injector - Invoca un método RPC en el servicio OfficeClickToRun que inyecta una DLL en un proceso suspendido que se ejecuta como NT AUTHORITY\SYSTEM lanzado por el servici...

5.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/09/25 2:40 a.m.•15 views

Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

5.8AI score
SaveExploits0References4
OSV
OSV
•added 2026/09/25 2:40 a.m.•6 views

MAL-2026-17169 Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

5.8AI score
SaveExploits0References4
Kitploit
Kitploit
•added 2026/09/25 2:39 a.m.•13 views

CVE-2025-6713

CVE-2025-6713 Creación de un pipeline de agregación para acceder a datos sin la autorización adecuada debido al manejo incorrecto de $mergeCursors en MongoDB v8.0 v7.0 v6.0 6.0.22 instalación no es muy difícil, solo usa pip3 para instalar los requisitos: pip install -r requirements uso python3...

7.7CVSS7.7AI score0.00389EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 2:37 a.m.•9 views

CVE-2026-25049

🚨 CVE-2026-25049 – Divulgación de configuración no autenticada en n8n 📌 Resumen ID CVE: CVE-2026-25049 Software afectado: n8n Gravedad: Crítica Categoría: Control de acceso inadecuado / Divulgación de información Esta vulnerabilidad permite acceso no autenticado a datos de configuración internos ...

9.9CVSS8.9AI score0.01484EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 2:32 a.m.•13 views

zip_smuggling

zipsmuggling Esta utilidad de Python crea archivos zip que contienen datos adicionales incrustados dentro de la estructura del archivo. Estos datos extra no son visibles/no se muestran cuando se examina o descomprime el zip, pero pueden recuperarse mediante powershell a través de un archivo de...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/25 2:29 a.m.•16 views

peeko

peeko Versión: v1.1 peeko es una herramienta C2 Comando y Control impulsada por XSS basada en navegador que aprovecha el navegador de la víctima como un proxy sigiloso dentro de redes internas. Mediante un payload XSS inyectado, peeko establece una conexión WebSocket a un servidor central, lo que...

5.9AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 2:16 a.m.•13 views

CVE-2022-22965

CVE-2022-22965 aka "Spring4Shell" RCE vulnerability in Spring Framework via Data Binding on JDK 9+ The goal is to centralize as much publicly known information as possible to date about the vulnerability and to know what actions to take in such a case. Is my application vulnerable? The conditions...

9.8CVSS7.7AI score0.99638EPSS
SaveExploits105
Kitploit
Kitploit
•added 2026/09/25 2:14 a.m.•13 views

CVE-2021-21424

CVE-2021-21424 Directory Traversal and file exposure • CVE-2021-21424 • Description: WebProfiler exposes internal server paths if it is not disabled in production. • Affected versions: Symfony 2.8 to 5.x. • Typical bypass: direct access to /appdev.php/profiler/. root@kitploit: Summary of...

5.3CVSS6.3AI score0.01712EPSS
SaveExploits0
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•118 views

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

7.2CVSS7.6AI score0.98464EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•71 views

Agentejo Cockpit <0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller. id: CVE-2020-35847 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critical description: | Agentejo Cockpit before 0.11.2 allows NoS...

9.8CVSS8.2AI score0.98165EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•170 views

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

5.3CVSS7.5AI score0.8764EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•65 views

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

9.8CVSS8.4AI score0.99826EPSS
SaveExploits21References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•39 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS8.9AI score0.7453EPSS
SaveExploits8References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•188 views

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

9.8CVSS8.7AI score0.97074EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•102 views

Mitel MiCollab - Authentication Bypass

A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the...

9.8CVSS8AI score0.9811EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•105 views

Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

9.8CVSS8.2AI score0.90067EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•62 views

Veeam Backup & Replication - Unauthenticated

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...

9.8CVSS8.9AI score0.90369EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•312 views

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

10CVSS7.7AI score0.99593EPSS
SaveExploits9References2
Rows per page
Query Builder