Check Point Quantum Gateway - Information Disclosure

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available. id: CVE-2024-24919 info: name: Check Poi...

ManageEngine ADManager Plus - Command Injection

Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings. id: CVE-2023-29084 info: name: ManageEngine ADManager Plus - Command Injection author: rootxharsh,iamnoooob,pdresearch severity: high description: | Zoho ManageEngine...

PayRange API

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image. 2. RECOMMENDED PRACTICES CISA...

Rently Smart Home

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

bug-bounty-reports-desai-vinayak

🧩 Report Bug Bounty — Desai Vinayak 🔒 Report di bug bounty e ricerca sulle vulnerabilità di Desai Vinayak. Questo repository raccoglie report passivi e non distruttivi su vulnerabilità e prove a supporto per divulgazione coordinata e tracciamento della risoluzione. 📁 Contenuti 📂 reports/ — PDF,...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Esposizione di informazioni non autenticata Il plugin g-FFL Cockpit non implementa controlli di autorizzazione adeguati sull'endpoint REST API serverstatus, consentendo a utenti non autenticati di accedere a informazioni sensibili sulla configurazione del server,...

CVE-2025-67159

CVE-2025-67159 — Vatilon-basierte IP-Kameras Zusammenfassung Die Firmware von Vatilon-basierten IP-Kameras enthält eine Authentifizierungsumgehung und Offenlegung von Klartext-Anmeldedaten in der API /cgi-bin/web.cgi. Die Weboberfläche verarbeitet Anfragen mit den Parametern username und password...

-Exploit-CVE-2017-7529

-Exploit-CVE-2017-7529 CVE-2017-7529: le versioni di Nginx dalla 0.5.6 fino alla 1.13.2 inclusa sono vulnerabili a una vulnerabilità di integer overflow nel modulo range filter di nginx, che comporta la divulgazione di informazioni potenzialmente sensibili innescata da una richiesta appositamente...

CVE-2024-32370

CVE-2024-32370 Descrizione della vulnerabilità Problema È stato identificato un problema in HSC Cybersecurity HSC Mailinspector versione 5.2.17-3, che consente a un attaccante remoto di ottenere informazioni sensibili tramite un payload appositamente predisposto al parametro id nel componente...

CVE-2024-32369

CVE-2024-32369 Beschreibung: SQL-Injection-Schwachstelle in HSC Cybersecurity HSC Mailinspector v.5.2.17-3 ermöglicht es einem entfernten Angreifer, sensible Informationen durch einen manipulierten Payload an die Start- und Limit-Parameter in der Komponente mliWhiteList.php zu erlangen. Versionen...

CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

CVE-2024-7339

CVE-2024-7339: Уязвимость утечки информации в DVR-устройствах. Exploiter — инструмент для обнаружения и эксплуатации уязвимости CVE-2024-7339 утечка информации в DVR-устройствах. Затрагивает более 400 000+ устройств, которые раскрывают информацию, такую как модель продукта, версия ядра и т.д...

53R3N17Y

53R3N17Y Script baseado em Python para Coleta de Informações. Para obter os detalhes, é usado hackertarget.com. Há um limite de 100 chamadas de API por dia a partir de um único endereço IP. Atualização root@kitploit: ----- | | |--o--| ╒ 53R3N17Y ════════════════════════════════════╕ ---------´...

Raccoon

Raccoon Strumento di Sicurezza Offensiva per Ricognizione e Raccolta Informazioni Caratteristiche Dettagli DNS Mappatura visiva DNS tramite DNS dumpster Informazioni WHOIS Dati TLS - cifrari supportati, versioni TLS, dettagli certificato e SAN Scansione porte Scansione servizi e script Fuzzing UR...

CVE-2026-10627 Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-65271

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by molten bit in WordPress Plugin Events Manager versions = 7.4.0...

CVE-2026-10627

The Events Manager plugin for WordPress (versions up to and including 7.4.0 ) is vulnerable to an authorization bypass via the status , private , and private_only parameters, which are not properly validated. This allows unauthenticated attackers to view the titles, dates, descriptions, and locat...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

DEBIAN-CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...