filessh

FileSSH A TUI-based file explorer for SSH servers, which allows you to browse and manage files on a remote server, edit them in-place, and recursively download directories with parallel directory traversal. It also has the ability to quickly spawn SSH sessions to paths on the remote server...

BitLeak

BitLeak BitLeak es una herramienta en Python que verifica y muestra descargas de torrents vinculadas a una dirección IP determinada. root@kitploit: git clone https://github.com/AnkhCorp/BitLeak.git root@kitploit: pip3 install -r requirements.txt root@kitploit: python bitleak.py...

Z-Downloads < 1.11.7 - Cross-Site Scripting

The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...

WordPress Candidate Application Form <= 1.3 - Local File Inclusion

WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. id: CVE-2015-1000005 info: name: WordPress Candidate Application Form = 1.3 - Local File Inclusion author: dhiyaneshDK severity: high...

Easy Digital Downloads - Privilege Escalation

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...

WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection

WordPress Easy Digital Downloads plugin 3.1.0.2 and 3.1.0.3 contains a SQL injection vulnerability in the s parameter of its edddownloadsearch action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

Wipro Holmes Orchestrator 20.4.1 - Information Disclosure

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12. id: CVE-2024-5057 info: name: WordPress Easy Digital Downloads = 3.2.12 - SQL Injecti...

hget

hget Este proyecto es mi proyecto personal para aprender Golang y construir algo útil. Estado de compilación : Instalación root@kitploit: $ go get -d github.com/huydx/hget $ cd $GOPATH/src/github.com/huydx/hget $ make clean install El archivo binario se generará en ./bin/hget. Puedes copiarlo a...

CVE-2025-14783-POC

🧨 CVE-2025-14783: Easy Digital Downloads Account Takeover PoC "La confianza es el fallo de seguridad más explotable." 💀 Descripción Este repositorio contiene una Prueba de Concepto PoC funcional para CVE-2025-14783 , una vulnerabilidad crítica de Password Reset Poisoning Envenenamiento de...

axios-ssrf

Comenzar ejecuta pnpm install en los directorios raíz, backend y frontend ejecuta pnpm start:dev en el directorio raíz Vulnerabilidades Este sitio web está publicado en: https://axios-ssrf.onrender.com/ Server Side Request Forgery: Utilicé específicamente una versión de axios que es vulnerable a...

CVE-2026-87935

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

CVE-2026-87935 Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

EUVD-2026-81334

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

CVE-2026-87935

The Paid Downloads WordPress plugin (versions ≤ 3.15) is vulnerable to an unauthenticated arbitrary file upload via the paiddownloads_update_file action. The root cause is missing authorization and file type validation in the admin_request_handler function, which is reachable without authenticati...

WordPress Paid Downloads plugin <= 3.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Spy0x7 in WordPress Plugin Paid Downloads versions = 3.15...

CVE-2026-82190

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

Astra Linux – Vulnerability in Firefox and Thunderbird

A spoofing issue exists in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page...