WordPress Events Manager <= 7.0.3 - SQL Injection

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

Keycloak - Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

AVM FRITZ!Box 7530 AX - Unauthorized Access

An access control issue in the component /juisboxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. id: CVE-2024-54767 info: name: AVM FRITZ!Box 7530 AX - Unauthorized Access author: DhiyaneshDK severity: high description: | An access...

CaA

Insight into information, exploring with intelligence in a thousand ways. First Author: EvilChen Second Author: 0chenccMystery Security TeamThird Author: Mystery Security Team...

CVE-2024-24919-Bulk-Scanner

CVE-2024-24919 批量扫描器 CVE-2024-24919 Check Point 安全网关信息泄露 脚本基于以下内容编写，致谢：https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ 此 Python 脚本通过发送特定的 POST 请求并检查响应头和状态码，扫描 URL 列表以发现 CVE-2024-24919 漏洞。它会记录请求和响应详情，并根据预定义的标准识别易受攻击的 URL。 !WARNING 仅用于企业环境中的教育和测试。 https://x.com/nav1n/ 与...

espectre

ESPectre Turn an ESP32 into a private, local Wi-Fi motion sensor. When someone moves through a room, they change the way Wi-Fi signals travel through it. ESPectre reads those changes and reports motion in real time. No camera, no microphone, no wearable, and no dedicated radar hardware: just a...

HawkScan

HawkScan Security Tool for Reconnaissance and Information Gathering on a website. python 3.x News Installation Special features TODO Usage Exemples Thanks Donations Tools used Wiki News v2.x root@kitploit: - Add proxy function - Redefining priorities/tasks - Let's debug certificate subdomains...

CVE-2023-23752

CVE-2023-23752 This is a proof-of-concept code for the CVE-2023-23752 vulnerability. It allows an attacker to extract sensitive information such as usernames, passwords, and database names from a target application. Usage To use this code, you can follow these steps: 1. Clone this repository or...

CVE-2023-28432

CVE-2023-28432 MinIO Information Disclosure Leaks Account Passwords The MinIO system has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all sensitive information, including MINIOSECRETKEY and MINIOROOTPASSWORD, by sending a specially crafted POST request to...

heartbleed-tools

OpenSSL Heartbleed CVE-2014-0160 vulnerability scanner, data miner and RSA key-restore tools. Author: Einar Otto Stangvik / @einaros / https://hacking.ventures Since the cat is long since out of the bag, and others have begun publishing their tools, I'm putting mine out there too. Hopefully this...

CVE-2019-8978

CVE-2019-8978 Improper Authentication CWE-287 in Ellucian Banner Web Tailor and Banner Enterprise Identity Services Author: Katie Mulliken [email protected] Thanks to: Carnegie Mellon University CERT Coordination Center Information Date Found: Dec. 17, 2018 Vendor: Ellucian Company L.P. Vend...

CVE-2026-35678

Vulnerability Research Report: All Eduplus Student ERP Insecure Direct Object Reference IDOR Researcher: Vinay Sharma 1. Executive Summary This report details a high-severity security vulnerability identified in the Eduplus Student ERP platform, specifically within the student learner portal...

CVE-2025-62168

CVE-2025-62168 Squid Proxy Information Disclosure in Error handling Scanner Detection & PoC "Due to a failure to redact HTTP Authentication credentials Squid is vulnerable to an Information Disclosure attack. Severity: This problem allows a script to bypass Browser security protections and learn...

CVE-2023-51127

CVE-2023-51127 FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic...

CVE-2026-29909-MRCMS-vulnerability

CVE-2026-29909: MRCMS V3.1.2 - Unauthenticated Directory Enumeration CVE ID CVE-2026-29909 Description MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input...

CVE-2023-21036

Acropalypse detection and sanitization tools You can use the python script acropalypsedetection.py or the yara rule acropalypsedetection.yar to detect cropped images affected by acropalypse: root@kitploit: $ for i in testimgs/; do python3 acropalypsedetection.py $i; done...

CVE-2023-28432

CVE-2023-28432 Minio is an object storage service written in Go. It implements most of the Amazon S3 cloud storage service interfaces and can be seen as an open-source version of S3, making it very suitable for storing large volumes of unstructured data such as images, videos, log files, backup...

CVE-2025-62168

CVE-2025-62168 Squid Proxy Information Disclosure in Error handling Scanner Detection & PoC "Due to a failure to redact HTTP Authentication credentials Squid is vulnerable to an Information Disclosure attack. Severity: This problem allows a script to bypass Browser security protections and learn...