Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

CVE-2021-41773

ApacheRCE ApacheRCE es un pequeño script de Python que te permitirá introducir la versión de Apache 2.4.49-2.4.50 y luego introducir una lista de direcciones IP desde un archivo de texto y ejecutar el exploit en masa sobre ellas. Esto puede ser útil si estás ejecutando múltiples sitios web y...

dvwassl

SSL-enabled Damn Vulnerable Web App Run an SSL-enabled Damn Vulnerable Web App. Why? You might want to test web attack detections over SSL. Build the image root@kitploit: docker build -t dvwassl:latest . Run the container root@kitploit: docker run -d -p 443:443 dvwassl:latest Custom SSL certifica...

CVE-2021-41773

CVE-2021-41773 PoC CVE-2021-41773 - Apache 2.4.49 con CGI habilitado Uso : root@kitploit: chmod -x CVE-2021-41773.sh ./CVE-2021-41773.sh http://ip:port/ /etc/passwd Referencias https://nvd.nist.gov/vuln/detail/CVE-2021-41773 https://vulners.com/cve/CVE-2021-41773...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

CVE-2024-21338

CVE-2024-21338 本地权限提升漏洞，从管理员权限提升至内核权限，影响启用了 HVCI 的 Windows 10 和 Windows 11 操作系统。 编译 使用安装了 C++ 包的 Microsoft Visual Studio，在 Release 和 Debug 模式下均可成功编译 PoC。 博文 原始博文：https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/...

CVE-2018-6789

CVE-2018-6789 环境搭建 安装依赖 root@kitploit: apt-get install gcc net-tools vim gdb python wget git make procps libpcre3-dev libdb-dev libxt-dev libxaw7-dev 下载旧版本的exim root@kitploit: wget ftp://mirror.easyname.at/exim-ftp/exim/exim4/old/exim-4.89.tar.gz tar -xvzf ./exim-4.89.tar.gz cd ./exim-4.89 cp...

CVE-2017-7529-POC

CVE-2017-7529-POC Descripción de la vulnerabilidad Esta vulnerabilidad afecta a todas las versiones de Nginx entre la 0.5.6 y la 1.13.2 que tengan activado el módulo de configuración por defecto. Basta con que el servidor tenga habilitado el almacenamiento en caché para que un atacante pueda envi...

AZL-100874 CVE-2026-89448 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

CVE-2026-67401

A SQL injection vulnerability in cPanel's EmailTrack component allows a mail-enabled hosting account to achieve remote code execution as root . Affected versions include 11.110, 11.134, 11.136, 11.138 , and WP Squared 11.138.1.9 , or any build below the patched version. The CVSS score is 9.9 (Cri...

CVE-2026-67401

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...

DEBIAN-CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

SUSE CVE-2026-80853

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems...

EUVD-2026-67818

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

CVE-2026-82287 Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...