Lucene search
+L

11736 matches found

Kitploit
Kitploit
added 2026/09/14 2:47 a.m.7 views

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 11:31 p.m.6 views

CVE-2021-38603

CVE-2021-38603 A stored cross site scripting vulnerability is present on the Profile edit page in the Information: field for each user. http:///core/admin/profil.php Vulnerable Fields: Information: Once inserted, XSS can be triggered by visiting any page/article created by that particular user...

4.8CVSS5.7AI score0.01095EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/13 9:23 p.m.5 views

CVE-2023-31703

CVE-2023-31703 — Reflected XSS in eScan Management Console Overview CVE ID: CVE-2023-31703 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium Discovered By: Sahil Ojha Disclosu...

9CVSS8.3AI score0.04475EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/13 7:31 p.m.5 views

CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC is a proof of concept for the vulnerability CVE-2025-15602 in Snipe-IT. One script to list all users and one script to take over an superadmin account. Context A user as only the right to edit users, he can abuse it to list and to do an account takeover of th...

8.8CVSS6AI score0.0046EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 6:05 p.m.8 views

CVE-2025-22710

CVE-2025-22710 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager Vulnerable version ⚠️ At least one post must exist to observe the difference in response values based on...

7.6CVSS8.1AI score0.00833EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 5:25 p.m.132 views

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

5.9AI score
SaveExploits0
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.70 views

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

6.1CVSS6.2AI score0.01317EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.58 views

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...

7.1CVSS7.9AI score0.00617EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.21 views

WordPress < 4.8.2 - Authenticated Open Redirect

WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...

5.4CVSS7AI score0.01886EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.27 views

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

9.8CVSS7.4AI score0.02455EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/13 3:48 a.m.11 views

CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

6.1CVSS5.9AI score0.00275EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/12 4:17 p.m.8 views

CVE-2022-43980

CVE-2022-43980 PandoraFMS 漏洞标题:存储型跨站脚本 日期:2023年2月15日 漏洞作者:Gaurish Kauthankar 厂商主页:https://pandorafms.com/en/ 软件链接:https://github.com/pandorafms/pandorafms 受影响版本: 测试环境:Ubuntu CVE编号:CVE-2022-43980 复现步骤 1. 低权限用户创建一个网络地图,将名称设置为XSS载荷。 2. 创建完成后,管理员用户必须点击编辑网络地图链接。 3. XSS载荷将被执行,可用于窃取管理员用户的Cookie值等操作。...

5.4CVSS6.7AI score0.0028EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/12 2:20 p.m.5 views

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

7.5CVSS7.4AI score0.01146EPSS
SaveExploits3
OSV
OSV
added 2026/09/11 9:12 p.m.6 views

CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the matrix-sdk-ui crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious...

4.9CVSS5.7AI score
SaveExploits0References6
CVE
CVE
added 2026/09/11 8:19 p.m.10 views

CVE-2026-81918

Concrete CMS versions below 9.5.3 are affected by a Stored XSS vulnerability in the Date Format field of the Page Attribute Display block . A user holding edit_page_contents permissions can store a payload that executes in the browser of any visitor who views a page where the block is configured ...

4.8CVSS0.00304EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 6:11 p.m.8 views

CVE-2023-48084-Revised

CVE-2023-48084 — PoC actualizado Repositorio: MettHK/CVE-2023-48084-Revised Versión actualizada de Hamibubu/CVE-2023-48084 con multihilo, extracción mediante búsqueda binaria y opciones de línea de comandos para seleccionar base de datos / tabla / columna. No es el repositorio original. Este es u...

9.8CVSS8.2AI score0.3374EPSS
SaveExploits3References3
NVD
NVD
added 2026/09/11 8:16 a.m.8 views

CVE-2026-6642

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

6.4CVSS0.00217EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE
added 2026/09/11 8:04 a.m.7 views

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

3.5CVSS0.0015EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 7:39 a.m.10 views

EUVD-2026-76008

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

6.4CVSS0.00217EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/11 7:39 a.m.44 views

CVE-2026-6642 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

6.4CVSS0.00217EPSS
SaveExploits0References8
Rows per page
Query Builder