CVE-2026-37066

CVE-2026-37066 パストラバーサルにより任意ファイル読み取りが可能となる脆弱性が、/vfm-admin/index.php および /vfm-admin/ajax/streamvid.php に存在します。Veno File Manager Project 4.4.9 において、スーパー管理者権限を持つ認証済み攻撃者が、影響を受けるエンドポイントに対して特別に細工された2つのHTTPリクエスト（POSTおよびGET）を送信することで、機密情報を漏洩させる可能性があります。...

CVE-2024-28995

CVE-2024-28995 SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. INSTALL git clone https://github.com/gotr00t0day/CVE-2024-28995.git cd CVE-2024-28995 pip3 install -r requirements.txt USAGE Scan a single...

EUVD-2026-62659

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...

CloudScraper

CloudScraperは、ターゲットをスパイダリングおよびスクレイピングしてクラウドリソースを探すツールです。URLを入力すると、スパイダリングを行い、スパイダリングされたページのソースから's3.amazonaws.com'、'windows.net'、'digitaloceanspaces'などの文字列を検索します。現在、AWS、Azure、Digital Oceanのリソースをサポートしています。 @okbyenow 前提条件 標準外のPythonライブラリ: requests rfc3987 termcolor Python 3.6で作成 概要 このツールは、Bryce...

CVE-2024-34472

CVE-2024-34472 描述： 已认证用户可利用 mliRealtimeEmails.php 文件中存在的盲 SQL 注入漏洞。向 /mailinspector/mliRealtimeEmails.php 发送 POST 请求时，ordemGrid 参数未正确过滤输入，导致已认证攻击者能够执行任意 SQL 命令，从而可能泄露整个应用程序数据库。 受影响版本： 在 HSC Mailinspector 5.2.17-3 中发现，但适用于直至 5.2.18 的所有版本。 概念验证 在浏览电子邮件收件箱时，检测到向 /mailinspector/mliRealtimeEmails.php...

SXDork

SXDork v1.0 SXDork is a powerful tool that utilizes the technique of google dorking to search for specific information on the internet. Google dorking is a method of using advanced search operators and keywords to uncover sensitive information that is publicly available on the internet. SXDork...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 Description This script automates the exploitation of CVE-2024-24919 Checkpoint Security Gateway Unauthorized Information Disclosure. 📌 Features ✅ Single & Bulk URL Testing ✅ Automated Exploitation ✅ Simple & Fast 🛠️ Usage Clone this repo and run the script: root@kitploit:...

Myesve

myesve CVE-2024-38475 Exploitation Framework – Version 1.0 Disclaimer: This tool is intended for authorized security testing, educational research, and legitimate bug bounty programs only. Do not use it against systems you do not own or lack explicit permission to test. The authors assume no...

CVE-2026-14663

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

EUVD-2026-70063

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

EUVD-2026-70059

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598

CVE-2026-78598 is an Incorrect Authorization (CWE-863) flaw in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space can cause a job's saved object to become accessible across all spaces in the instance, exposing data t...

CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...

EUVD-2026-70055

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...

CVE-2026-78602

Elastic Maps Server is affected by a path traversal (CWE-22) vulnerability that allows an unauthenticated network attacker to read files outside the server's intended content directory, resulting in information disclosure . The vulnerable versions are 8.19.11 through 8.19.18 , 9.3.0 through 9.4.3...