Lucene search
+L

69740 matches found

Kitploit
Kitploit
added 2026/09/13 9:39 a.m.8 views

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...

10CVSS6AI score0.54677EPSS
SaveExploits30References5
Kitploit
Kitploit
added 2026/09/13 9:26 a.m.9 views

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – AI Chatbot for WordPress = 2.5.1 - Unauthenticated Information Exposure The MxChat Basic plugin does not verify session ownership in the mxchatfetchconversationhistory AJAX endpoint, allowing unauthenticated users to access other users' conversation history and IP...

5.3CVSS6AI score0.00325EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 8:01 a.m.13 views

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Summary Tenda AC15 firmware V15.03.05.18multi issues an authentication cookie in the form password= and returns it without HttpOnly, Secure, or SameSite flags, exposing the password hash to the client. The low-entropy suffix acts as a predictable session identifier,...

9.8CVSS8.6AI score0.00466EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 7:51 a.m.6 views

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache

CVE-2024-12008-information-exposure-vulnerability-in-W3-Total-Cache CVE-2024-12008 information exposure vulnerability in W3 Total Cache...

7.5CVSS8.4AI score0.02269EPSS
SaveExploits0
CVE
CVE
added 2026/09/13 6:00 a.m.14 views

CVE-2026-86407

The User Registration & Membership WordPress plugin before 5.2.8 fails to verify that a visitor requesting its membership confirmation (thank you) page actually owns the account named in the request or that any registration/purchase occurred. This allows unauthenticated users to retrieve another ...

3.7CVSS5.5AI score0.00178EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 5:06 a.m.8 views

CVE-2021-40375

CVE-2021-40375 - Broken Access Control in OpenEyes 3.5.1 Description An improper access control vulnerability was identified in OpenEyes 3.5.1, developed by the Apperta Foundation. A low privileged user could load a patient's profile in their browser and access sensitive information without the...

6.5CVSS6.7AI score0.01649EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 4:59 a.m.8 views

JEFAZO-CVE-2025-55182-Checker

JEFAZO-CVE-2025-55182-Checker Description JEFAZO-CVE-2025-55182-Checker is a passive analysis tool designed to identify indicators related to CVE-2025-55182 in applications built with Next.js and React Server Components RSC. The tool performs safe and non-intrusive checks, without attempting to...

10CVSS7.8AI score0.99802EPSS
SaveExploits391
Kitploit
Kitploit
added 2026/09/13 3:49 a.m.11 views

CVE-2026-37069

CVE-2026-37069 Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

5.3CVSS5.8AI score0.00261EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 2:32 a.m.8 views

CVE-2019-6693

CVE-2019-6693 Have you changed your default FortiGate encryption keys? Run this script and find out! You can provide the entire configuration file dump or individual encrypted values. If the decrypted values aren't complete nonsense or produce a word, then it is likely the encryption key is left ...

6.5CVSS7AI score0.05663EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 2:08 a.m.5 views

CVE-2024-0368

CVE-2024-0368 Hustle Plugin = 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php Vulnerability Summary...

8.6CVSS8.2AI score0.00783EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/13 1:23 a.m.6 views

CVE-2025-51643

CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...

2.4CVSS6.1AI score0.0026EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 12:16 a.m.8 views

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

8.8CVSS7.5AI score0.8581EPSS
SaveExploits2References1
Cvelist
Cvelist
added 2026/09/13 12:00 a.m.28 views

CVE-2025-70819

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/hetc:rw in a compose file...

6.3CVSS0.00106EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/13 12:00 a.m.14 views

CVE-2020-15875

LibreNMS 1.65 is vulnerable to an authenticated SQL injection via the searchPhrase parameter in the /ajax_table.php API endpoint. A remote attacker with normal privileges can extract all information from the database. The flaw affects multiple .inc.php files under includes/html/table, including a...

5CVSS5.8AI score0.0028EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/12 11:37 p.m.8 views

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

7.5CVSS6.2AI score0.0134EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/12 10:36 p.m.6 views

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file...

8.6CVSS7.1AI score0.18087EPSS
SaveExploits18References2
Kitploit
Kitploit
added 2026/09/12 10:32 p.m.6 views

CVE-2025-44823

Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo CVE ID: CVE-2025-44823 Date: 2025-04-02 Authors: Alex Tisdale, Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

9.9CVSS8.4AI score0.16118EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/12 6:45 p.m.10 views

CVE-2025-63943

CVE-2025-63943 — SQL Injection in Grocery Store Management System 1.0 Overview A high-severity SQL Injection vulnerability was identified in the searchproducts.php component of Grocery Store Management System 1.0 , a PHP/MySQL-based web application created by anirudhkannan. The issue arises from...

5.8AI score
SaveExploits1References1
NVD
NVD
added 2026/09/12 6:16 p.m.11 views

CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

6.9CVSS0.00124EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/12 6:16 p.m.16 views

DEBIAN-CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

6.9CVSS5.8AI score0.00124EPSS
SaveExploits0References1
Rows per page
Query Builder