CVE-2020-12641

CVE-2020-12641: Befehlseinschleusung über den Parameter „imconvertpath“ in Roundcube Webmail In Roundcube-Versionen vor 1.4.4, 1.3.11 und 1.2.10 besteht eine Schwachstelle durch Befehlseinschleusung. Da der Parameter „imconvertpath“ keine Bereinigung/Eingabevalidierung durchführt, kann ein...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

CVE-2026-11834

CVE-2026-11834 PoC RCE non autenticata su DHCP Option 66 di TP-Link CVE-2026-11834 Panoramica Una vulnerabilità di iniezione di comandi CWE-78 nella gestione dell'Opzione 66 DHCP "TFTP Server Name" del firmware dei router TP-Link consente a un attaccante non autenticato sullo stesso segmento di...

rails-cve-2017-17917

rails-cve-2017-17917 यह परियोजना id पैरामीटर में SQL इंजेक्शन भेद्यता के प्रतिकृति को प्रदर्शित करती है, और बाद में इस सुरक्षा मुद्दे को कम करने और हल करने के लिए अंतर्दृष्टि प्रदान करती है। https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 स्टैक : root@kitploit: Ruby: 3.2.2 Rails:...

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence AI-powered, agentic integrated development environment IDE, that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE...

CVE-2026-79770

A flaw was found in Nokogiri. A remote attacker can inject specially crafted CSS selectors into methods such as Nodecss or Nodeatcss. This injection can lead to regular expression denial of service ReDoS due to exponential regex backtracking, causing the application to become unresponsive...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE durch Lua-Injection Autor: 0xgh057r3c0n 🧠 Beschreibung Dieser Exploit nutzt eine Lua-Injection-Schwachstelle im Login-Handler loginok.html des Wing FTP Servers aus, um beliebige Betriebssystembefehle auszuführen oder eine Reverse Shell zu erhalten. Er...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Il gestore software di Linux Mint v 7.9.5/9 ci fa eseguire l'iniezione di oggetti e codice arbitrario a causa di una configurazione errata. root@kitploit:...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827

Flowintel versions >=3.3.0 contained a validation flaw in the login flow: the code called Email(email) (which only constructs a WTForms validator object) instead of Email()(form, form.email), so malformed attacker-supplied email values bypassed validation. Because CR/LF characters in the email...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

EUVD-2026-67133

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Vulnerabilità di Cross Site Scripting Riflessa Esiste una vulnerabilità di Cross Site Scripting riflessa in più pagine della versione 3.0.2 dell'applicazione Hotel Druid che consente l'esecuzione arbitraria di comandi JavaScript...

CVE-2019-13292-WebERP_4.15

Exploit di Blind SQL Injection per WebERP Questo è uno script Python3 che dimostra un exploit per una vulnerabilità di Blind SQL Injection in WebERP versione 4.15, scoperta inizialmente da Semen Alexandrovich Lyhin il 10 giugno 2019. L'exploit originale può essere trovato qui, e ulteriori dettagl...

CVE-2021-45041

CVE-2021-45041 PoC per CVE-2021-45041 aka SCRMBT-177 - SQL-Injection autenticata in SuiteCRM = 8.0.0. Default: False --help Mostra questo messaggio e termina. https://github.com/manuelz120/CVE-2021-45041 Esempio di utilizzo: root@kitploit: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host...

CVE-2023-36163

Exploit-Titel: BuildaGate5library - Reflektiertes Cross-Site Scripting XSS Datum: 06/07/2023 Exploit-Autor: Idan Malihi Hersteller-Startseite: Keine Version: 5 Getestet auf: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: Ein Angreifer muss den verwundbaren Parameter mc= finden und den JS-Code...

CVE-2016-10033

PoC de exploração do CVE2016-10033 Este repositório contém os arquivos necessários para explorar o CVE2016-10033 em uma versão vulnerável do WordPress. Com estas instruções, você será capaz de obter um shell interativo reverso não Pseudo-TTY no contêiner que está executando o WordPress, como o...

CVE-2021-39165

CVE-2021-39165 Python3 POC für CVE-2021-39165 in CachetHQ Verwendung Zuerst solltest du die Abhängigkeiten installieren: root@kitploit: pip3 install -r requirements.txt Wenn du prüfen möchtest, ob die Ziel-URL verwundbar ist, kannst du Folgendes ausführen: root@kitploit: python3 exploit.py -u -c...

CVE-2019-14234

POC-Django JSONField/HStoreField Vulnerabilità di SQL Injection Exploit CVE-2019-14234 Django ha rilasciato un aggiornamento di sicurezza il 1 agosto 2019, che corregge una vulnerabilità di SQL injection nei due campi del modello JSONField e HStoreField. Link di riferimento:...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE Un PoC per CVE-2024-27956, un SQL Injection nel plugin ValvePress Automatic. Questo PoC sfrutta la vulnerabilità creando un utente nel target e assegnando diritti di Amministratore. Essere un amministratore in WordPress può portare a Remote Code Execution. Utilizzo...