CVE-2023-3519

CVE-2023-3519 Porque você pode executar o powershell no PC da sua mãe sem precisar instalar NMAP ou PYTHON nem contar pra ninguém que você usa ARCH! ; x...

CVE-2022-28346

CVE-2022-28346 PoC Impatto: Potenziale SQL injection in QuerySet.annotate, aggregate ed extra. Installazione root@kitploit: poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC root@kitploit: ?field=poc.title"...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

WordPress Ocean Extra plugin before 1.9.5 contains a cross-site scripting vulnerability. The plugin does not escape generated links which are then used when the OceanWP theme is active. id: CVE-2021-25104 info: name: WordPress Ocean Extra 1.9.5 - Cross-Site Scripting author: Akincibor severity:...

CVE-2022-28346

CVE-2022-28346 Iniezione SQL in QuerySet.annotate, aggregate e extra Configurazione: Esegui ./setup.sh per la configurazione iniziale Apri l'immagine docker per avviare il database: docker exec -it containerid /bin/bash Esegui i seguenti comandi: root@kitploit: python manage.py makemigrations...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503

Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple Stored XSS v2.2.18 लेखक: सर्जियो विवरण: CMSmadesimple v.2.2.18 में क्रॉस-साइट स्क्रिप्टिंग भेद्यता एक स्थानीय हमलावर को Content - News Menu के Extra में क्राफ्टेड स्क्रिप्ट के माध्यम से मनमाना कोड निष्पादित करने की अनुमति देती है। हमले के वेक्टर: स्क्रिप्टिंग "Content - News Menu" क...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ConcreteCMS v.9.2.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nella sezione SEO - Extra dalle Impostazioni della Pagina. Vettori di...

puppeteer-extra

puppeteer-extra Questo è il monorepo per puppeteer-extra, un framework modulare per plugin per puppeteer. :- 🌟 Per la documentazione principale, consulta il pacchettopuppeteer-extra. Abbiamo anche recentemente introdotto il supporto per Playwright; se ti interessa, dai un'occhiata a...

CVE-2022-28346

CVE-2022-28346 SQL-Injection in Django QuerySet.annotate, aggregate, extra Initialisierung der Umgebung root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3. Rufe http://x.x.x.x:8000/ auf und füge Initialisierungsdaten ein Reproduktion der Schwachstelle root@kitploit: Ruf...

CVE-2026-74008

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme = 2.17.22 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

EUVD-2026-60937

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181

Extra Product Options & Add-Ons for WooCommerce plugin versions below 7.6 allow unauthenticated attackers to download arbitrary files, exposing sensitive data with CVSS 7.5 (HIGH). PatchStack reports the flaw; no exploit code is provided. Upgrade to version 7.6 or later to remediate. Exploitation...

CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...