EUVD-2026-78281

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

EUVD-2026-78282

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

ctl_ctloutput-leak

ctlctloutput-leak macOS High Sierra 10.13 の ctlctloutput 関数は、sooptcopyin の呼び出しの戻り値を無視します。これにより、初期化されていないカーネルヒープデータをユーザースペースに漏えいさせる競合ウィンドウが生じます。ctlctloutput-leak は、この情報漏えいを引き起こそうとする proof-of-concept エクスプロイトです。悪用には root 権限が必要です。 このエクスプロイトは、macOS High Sierra 10.13.1 Beta 17B25c および iOS 10.1.1...

libget_user_exploit

这个库利用CVE-2013-6282漏洞读取内核内存。...

EUVD-2026-78279

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...

CVE-2021-42013

CVE-2021-42013 Poc CVE-2021-42013 - 未启用CGI的Apache 2.4.50 用法： root@kitploit: chmod -x CVE-2021-42013.sh ./CVE-2021-42013.sh http://ip:port/ /etc/passwd 参考来源 https://nvd.nist.gov/vuln/detail/CVE-2021-42013 https://vulners.com/cve/CVE-2021-42013...

BigBountyRecon

BigBountyRecon BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. Reconnaissance is the most important step in any penetration testing or a bug hunting process. It...

CVE-2026-17495

creationtimestamp| type| source ---|---|--- 2026-09-15 05:47:41+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mvjwfdj2gk2l...

CVE-2023-27703

CVE-2023-27703 CVE-2023-27703 Android版pikpak V1.29.2の要素デバッグインターフェース漏洩の脆弱性 pikpak 1.30.1で修正 推奨説明 pikpak v1.29.2のAndroid版は、デバッグインターフェースを介した情報漏洩を含むことが発見されました。 追加情報 詳細リンク:https://drive.google.com/drive/folders/1Szu9pjivVtG93ceECvnoAjeSABVyfDES?usp=sharing 脆弱性タイプ 不適切なアクセス制御 製品ベンダー https://mypikpak.com...

Prommetrix

情報: Prommetrixは、'Prometheus'によって実行される'Node Exporter'のインスタンスから関連情報を取得するためのフリーソフトウェアツールです。 Prometheusは、クラウドアプリケーション向けのオープンソースのメトリクスベースのイベント監視およびアラートソリューションです。Uber、Slack、Robinhoodなどを含む約800のクラウドネイティブ組織で使用されています。Prometheusは、さまざまなエンドポイントからリアルタイムメトリクスをスクレイピングすることで、メモリ使用量、ネットワーク使用量、ソフトウェア固有の定義メトリクス（例:...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

EyouCms v1.6.3 - Information Disclosure

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custommodelpath/recruit.filelist.txt. id: CVE-2023-37645 info: name: EyouCms v1.6.3 - Information Disclosure author: pussycat0x severity: medium description: | EyouCms v1.6.3 was discovered to...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

FXServer < v9601 - Information Exposure

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint. id: CVE-2024-46310 info: name: FXServer v9601 - Information Exposure author: s4e-io severity: medium description: | Incorrect Access...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...