Lucene search
+L

52455 matches found

Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•102 views

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

9.8CVSS8.5AI score0.90081EPSS
SaveExploits1References2
Kitploit
Kitploit
•added 2026/09/25 1:19 a.m.•15 views

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

6.5CVSS6AI score0.00291EPSS
SaveExploits2
Kitploit
Kitploit
•added 2026/09/25 1:10 a.m.•12 views

CVE-2026-1657

CVE-2026-1657: Carga Arbitraria de Archivos sin Autenticación en el Plugin EventPrime Aviso de exención de responsabilidad: Este repositorio se crea con fines educativos y divulgación ética exclusivamente. La vulnerabilidad ha sido reportada responsablemente al proveedor y ha sido parcheada. No...

5.3CVSS6.1AI score0.00394EPSS
SaveExploits3
Kitploit
Kitploit
•added 2026/09/25 12:02 a.m.•7 views

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 Spring-Cloud-Gateway In the first quarter of 2022, an interesting and critical base score of 10.0 Spring Cloud Gateway Code Injection vulnerability was discovered leveraging the Actuator API to perform SpEL Injection, potentially leading to system compromise. Spring...

10CVSS8AI score0.98253EPSS
SaveExploits54
Kitploit
Kitploit
•added 2026/09/25 12:02 a.m.•7 views

CVE-2025-57819-ioc-check

CVE-2025-57819-ioc-check Description CVE-2024-6387-ioc-check is a lightweight, efficient tool designed to identify IoCs on freepbx servers with any of endpoint Users should upgrade to the latest supported versions of FreePBX currently 15, 16, and 17 and confirm that the installed "endpoint" modul...

10CVSS7.3AI score0.99506EPSS
SaveExploits100References1
Tenable Nessus
Tenable Nessus
•added 2026/09/25 12:00 a.m.•9 views

Linux Distros Unpatched Vulnerability : CVE-2026-67410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. wh...

8.2CVSS5.8AI score0.00401EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/25 12:00 a.m.•3 views

CVE-2026-84460: Authorization Bypass Through User-Controlled Key

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

5.3CVSS5.8AI score0.00259EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/25 12:00 a.m.•4 views

CVE-2026-100502: Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

5.9CVSS6AI score0.00289EPSS
SaveExploits0References2
Kitploit
Kitploit
•added 2026/09/24 11:55 p.m.•14 views

CVE-2025-6082

CVE-2025-6082 PoC de Divulgación de Ruta Completa Autor : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 Vulnerabilidad : Divulgación de Ruta Completa CWE-200 Descripción Este PoC explota un fallo de Divulgación de Ruta Completa en el plugin de WordPress Birth Chart Compatibility version...

5.3CVSS6.1AI score0.0154EPSS
SaveExploits2
Kitploit
Kitploit
•added 2026/09/24 11:53 p.m.•11 views

CVE-2025-54769

CVE-2025-54769 – LPAR2RRD RCE 描述 : 本仓库包含 CVE-2025-54769 的概念验证 PoC 利用代码,该漏洞存在于 lpar2rrd 中。 此漏洞通过滥用 /lpar2rrd-cgi/upgrade.sh 接口,可实现远程代码执行(RCE)和目录遍历。漏洞利用流程如下: 脚本生成 : 自动创建一个恶意 Perl CGI 载荷(users.pl),该载荷可执行任意 shell 命令(默认:whoami)。 载荷上传 : 使用 libcurl 将生成的脚本作为“升级包” POST 到易受攻击的接口,绕过基本的文件验证。 目录遍历 :...

6.1AI score0.03328EPSS
SaveExploits4
Kitploit
Kitploit
•added 2026/09/24 11:45 p.m.•10 views

SECURITY-3314-3315

= SECURITY-3314/SECURITY-3315 缓解措施 此仓库记录了防止在受影响实例上利用 SECURITY-3314 和 SECURITY-3315 的缓解措施。 == 概述 需要禁用对 CLI 的访问。 必须采取以下两个步骤: 移除 CLI HTTP 端点 禁用 SSH 端口(https://plugins.jenkins.io/sshd/SSH Server Plugin) NOTE 基于 remoting 的 CLI 已在 Jenkins 中移除...

5.9AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 11:37 p.m.•20 views

CVE-2025-9172

Exploit: Inyección SQL basada en tiempo vía /vibes/v1/beacon sin autenticación PoC de la consola del navegador async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL...

7.5CVSS6.1AI score0.00429EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 11:25 p.m.•13 views

CVE-2025-9967

漏洞利用:未经身份验证的OTP密码重置 浏览器控制台PoC(无需认证) async = async function getNonceAndAjaxUrl if window.resetpassobj return nonce: resetpassobj.ajaxnonce, ajaxUrl: resetpassobj.ajaxurl ; const home = await fetch'http://localhost/wordpress/'.thenr = r.text; const m =...

9.8CVSS5.9AI score0.00428EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 10:39 p.m.•11 views

CVE-2026-25513

CVE-2026-25513: FacturaScripts tiene una inyección SQL en la cláusula ORDER BY de la API Descripción general Campo| Detalles ---|--- ID de CVE| CVE-2026-25513 Gravedad| ALTA Aviso| Ver aviso Descubierto por| Lukasz Rybak Productos afectados facturascripts/facturascripts versiones: 2025.81...

8.8CVSS6.3AI score0.00523EPSS
SaveExploits3References2
Kitploit
Kitploit
•added 2026/09/24 10:38 p.m.•18 views

0-click-RCE-Exploit-for-CVE-2024-9932

CVE-2024-9932 / Exploit RCE de 0 clics Autor: Joshua Provoste https://x.com/JoshuaProvoste/status/1858329238153072668 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-9932, una vulnerabilidad de subida arbitraria de archivos sin autenticación en el plugin Wux Blog Editor d...

9.8CVSS6.2AI score0.36395EPSS
SaveExploits5
Kitploit
Kitploit
•added 2026/09/24 10:30 p.m.•14 views

CVE-2025-68645

ZimLFI-Hunter CVE-2025-68645 ZimLFI-Hunter es un escáner profesional de Prueba de Concepto PoC diseñado para identificar la vulnerabilidad CVE-2025-68645 en Zimbra Collaboration Suite. Esta herramienta detecta fallos de Inclusión de Archivos Locales LFI a través del endpoint /h/printcalendar. 🛡️...

8.8CVSS8.3AI score0.48873EPSS
SaveExploits6
Kitploit
Kitploit
•added 2026/09/24 10:25 p.m.•11 views

TS_LLMLib

tsllmlib - TrustedSec LLM Library TrustedSec LLM Library es una biblioteca de Python para interactuar con LLM locales que admiten el uso de herramientas. Permite ejecutar grandes flujos de trabajo tradicionalmente solo posibles con modelos de frontera, aprovechando los endpoints de LLM locales y ...

6.1AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 9:30 p.m.•10 views

CVE-2026-5173

🦊 CVE-2026-5173: PoC de Ejecución No Autorizada de Métodos en GitLab WebSocket 🛠️ Resumen CVE-2026-5173 permite a un atacante autenticado con bajos privilegios invocar métodos backend restringidos a través del endpoint WebSocket /-/cable de GitLab, específicamente mediante GraphqlChannel. Esto...

8.5CVSS8AI score0.00364EPSS
SaveExploits0References3
Kitploit
Kitploit
•added 2026/09/24 8:56 p.m.•15 views

CVE-2025-10294

漏洞利用:通过空的 ownidsharedsecret 绕过认证(JWT伪造) 1 使用空HMAC密钥伪造有效的JWT SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header = b64ujson.dumps"typ":"JWT","alg":"HS256", separators=",",":".encode payload =...

9.8CVSS8.7AI score0.00787EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 8:55 p.m.•12 views

CVE-2025-52204

CVE-2025-52204 – Znuny customer.pl 端点中的反射型XSS/HTML注入 摘要 Znuny 存在反射型跨站脚本(XSS)和 HTML 注入漏洞,攻击者可通过系统配置 CustomerPanelSessionName 定义的参数在 customer.pl 端点注入任意 JavaScript 或 HTML。 分类 CVE: CVE-2025-52204 CWE: CWE-79 – 网页生成过程中输入的不当中和('跨站脚本') CVSS v3.1(研究人员评估): 6.1 中等 CVSS Vector:...

6.1CVSS5.9AI score0.00236EPSS
SaveExploits1
Rows per page
Query Builder