CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. This allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the platform for creating individual web applications in CRM. The leader involved in this issue faces unlimited distribution of resources, allowing attackers to compromise the accessibility of protected information.

The vulnerability of the platform for creating individual web applications in CRM involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...

The vulnerability of the Serial Wire Debug interface (SWD) in the highly integrated wireless system on chip (SoC) Realtek RTL8762C allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the Serial Wire Debug SWD interface in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to improper protection against voltage and clock failures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and...

Blitz Identity Provider (Authentication server)

...

CVE-2026-86555

The ZTE SmartLife mobile application contains a hardcoded key used to decrypt account server information. The key is stored in plaintext within the application code, so an attacker with access to the binary can extract it and decrypt the protected server configuration data. The CVSS v3.1 score is...

EUVD-2026-83717

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...

CVE-2026-93971

An information disclosure vulnerability was identified in aiyiyi121 SxDevOps versions 1.0 and 1.1, located in an unknown function of the file backend/sxdevops/settings.py . The weakness can be exploited remotely without authentication, leading to a low confidentiality impact (CVSS 3.1: 5.3 Medium...

EUVD-2026-83707

A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disclosure. It is possible to initiate the attack remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is...

ohmybackup

ohmybackup ohmybackup - 扫描受害者的备份目录和备份文件 ohmybackup 扫描目标站点上的备份文件夹。在找到的文件夹中搜索归档文件。 通过2文件扫描系统，它以不同的方式添加扩展名和文件名，从而增加被发现的几率。 1 - files/extensions.txt - 这为文件添加新的扩展名，例如：通过添加 .example 的形式，允许您重新尝试所有在新扩展名中尝试过的可能性。 2 - files/files.txt - 它可以根据您添加的扩展名，通过赋予它们新的文件名来扫描这些文件夹。 3 - files/folders.txt -...

bfac

BFAC Advanced Backup-File Artifacts Testing for Web-Applications BFAC Backup File Artifacts Checker is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords,...

pillager

...

CVE-2020-14181

CVE-2020-14181 PoC para CVE-2020-14181 Las versiones afectadas de Atlassian Jira Server y Data Center permiten a un usuario no autenticado enumerar usuarios a través de una vulnerabilidad de divulgación de información en el endpoint /ViewUserHover.jspa. Esta vulnerabilidad fue descubierta por...

Joomla-CVE-2023-23752

Joomla-CVE-2023-23752 此Python实现通过演示CVE-2023-23752的利用过程，达到教育目的。该代码提供了关于如何利用此漏洞的见解。 目录 关于 安装 用法 贡献 漏洞环境部署 致谢 许可证 免责声明 关于 本项目展示了一个Python实现，旨在演示CVE-2023-23752信息泄露漏洞。它包含一个docker-compose.yml文件，以简化设置和执行，使其对于高效演示或测试概念验证特别有用。 安装 要正确运行exploit.py文件，请下载项目文件并执行以下代码以安装必要的依赖： root@kitploit: pip install -r...

CVE-2019-7642

CVE-2019-7642 Los routers D-Link con la función mydlink tienen algunas interfaces web sin requisitos de autenticación. Un atacante puede obtener de forma remota los registros de consultas DNS y los registros de inicio de sesión de los usuarios. Los objetivos vulnerables incluyen, entre otros, las...

CVE-2022-46463

CVE-2022-46463 Harbor public镜像下载 Harbor是一款开源的镜像托管平台。 此脚本通过列举所有的pulic镜像，支持dump操作（类似docker pull），方便从公开暴露的镜像中查找敏感泄漏信息。 Usage root@kitploit: $ python3 harbor.py https://192.168.11.11 + grafana/grafana + library/openjdk $ python3 harbor.py https://192.168.11.11 --dump library/openjdk:8 + Dumping...

longtongue

基于目标信息生成自定义密码/密码短语单词列表 由 edoardottt 用 💙 编写 在 Twitter 上分享！ 安装 ⬇️ pipx root@kitploit: pipx install longtongue 源码 root@kitploit: git clone https://github.com/edoardottt/longtongue.git cd longtongue pip install -r requirements.txt python3 longtongue.py 使用方法 💻 root@kitploit: usage: longtongue -h -p | -...

lua-ffi-libinjection

Name lua-resty-libinjection - LuaJIT FFI bindings for libinjection Status This library is in active development and is production ready Description This library provides FFI bindings for libinjection, a SQL/SQLi and XSS tokenizer and analyzer. Installation Install this library as you would any...

AppInfoScanner

该项目目前仅仅是规划项目中的冰山一角，如果您对此项目感兴趣或者想参与后继项目的开发工作或者翻译工作中，请发送邮件至[email protected]说明你的能力和诉求。 AppInfoScanner 一款适用于以HW行动/红队/渗透测试团队为场景的移动端Android、iOS、WEB、H5、静态网站信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。 前言...

trape

trape stable v2.0 People tracker on the Internet: Learn to track the world, to avoid being traced. Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how larg...