Lucene search
+L

30879 matches found

Kitploit
Kitploit
added 2026/09/13 4:52 p.m.8 views

CVE-2025-70341

CVE-2025-70341: Insecure Permissions + Arbitrary Code Execution in App-Auto-Patch Summary App-Auto-Patch v3.4.2 creates its working directory with world-writable permissions chmod 777, enabling a local TOCTOU time-of-check-time-of-use race condition. An unprivileged local attacker can exploit thi...

7.8CVSS6.2AI score0.00216EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.25 views

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

8.6CVSS7.2AI score0.49051EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.25 views

DataEase 2.10.4-2.10.7 - Remote Code Execution

DataEase prior to version 2.10.8 contains a remote code execution caused by insecure backend JDBC link handling, letting authenticated users execute arbitrary code, exploit requires user authentication. id: CVE-2025-32966 info: name: DataEase 2.10.4-2.10.7 - Remote Code Execution author: ChrisJr4...

9.8CVSS6.6AI score0.04396EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.75 views

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

9.8CVSS8.5AI score0.97271EPSS
SaveExploits79References6
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.97 views

osCommerce 2.3.4.1 - Remote Code Execution

osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install4.php, exploit requires accessible /install/ directory after...

9.3CVSS6.6AI score0.04122EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.7 views

GiveWP <= 4.16.7.1 - Remote Code Execution

GiveWP = 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input id: CVE-2026-82222 info: name: GiveWP = 4.16.7.1 - Remote Code Execution author: 0xAkoko,pdteam...

10CVSS0.01547EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.59 views

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

8.8CVSS8AI score0.80069EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.26 views

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

9.8CVSS7.9AI score0.36513EPSS
SaveExploits2References4
Kitploit
Kitploit
added 2026/09/13 4:17 p.m.6 views

CVE-2025-26318

TSplus Remote Access - CVE-2025-26318 Insecure Permissions Information Disclosure 📌 Description TSplus is, by default, vulnerable to the disclosure of information from users currently connected to the domain on TSplus. 🔍 Vulnerability Details CVE ID : CVE-2025-26318 Vendor : TSplus Affected...

5.8CVSS5.8AI score0.00935EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/13 3:50 p.m.5 views

coolermaster-masterctrl-vuln

coolermaster-masterctrl-vuln CVE-2025-52216 – Cooler Master MasterCTRL Silent Installation of Insecure Services...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 3:47 p.m.5 views

CVE-2022-22733

CVE-2022-22733 CVE-2022-22733 is a vulnerabilit that affects Apache ShardingSphere ElasticJob-UI 3.0.0 and below versions, The vulnerability lead to Privilege Escalation. But, with abusing of the escalated privileges a JDBC Attack it can preformed & achieve RCE. You can read the vulnerability...

6.5CVSS6.8AI score0.37594EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/13 3:39 p.m.6 views

CVE-2025-50675-GPMAW-Permissions

CVE-2025-50675 – Insecure Permissions in GPMAW 14.2 Summary CVE-2025-50675 affects GPMAW 14.2, a bioinformatics software developed by Lighthouse Data. The installer creates the folder C:\Program Files\gpmaw with full control granted to the 'Everyone' group , allowing any local user to modify file...

7.8CVSS5.9AI score0.00228EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 3:37 p.m.4 views

sharepoint-toolshell-cve-2025-53770

SharePoint "ToolShell" RCE Exploit CVE-2025-53770 Overview CVE-2025-53770 is a critical remote code execution RCE vulnerability affecting Microsoft SharePoint Server 2016, 2019, and Subscription Edition on-premises only, not SharePoint Online. Attackers can bypass authentication and achieve full...

9.8CVSS7.9AI score0.99998EPSS
SaveExploits42
Kitploit
Kitploit
added 2026/09/13 3:22 p.m.7 views

CVE-2020-14066

Icewarp Email Server 12.3.0.1 insecurepermissions https://nvd.nist.gov/vuln/detail/CVE-2020-14066...

8.8CVSS8.2AI score0.01774EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 3:18 p.m.9 views

cve-2021-33879

CVEID : CVE-2021-33879 Name of the affected products and versions : GameLoop all versions prior to 4.1.21.90 Vulnerability type : CWE-494: Download of Code Without Integrity Check Summary GameLoop is an Android emulator developed by Tencent. It features an update mechanism which is not encrypted ...

8.1CVSS7.5AI score0.01022EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 3:13 p.m.7 views

CVE-2024-1651-PoC

CVE-2024-1651 This CVE was discovered by Carlos Bello from the Fluid Attack Offensive Team. The finding discusses Insecure Object Deserialization to obtain RCE Remote Code Execution. Here, I have created a faster and easier-to-use PoC Proof of Concept. Therefore, if anyone wants to reproduce the...

10CVSS8.1AI score0.34235EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/13 3:03 p.m.2 views

cve-2025-55182-analysis

CVE-2025-55182 — React Server Components RCE Analysis Web application vulnerability analysis · M2 Cybersecurity · 2025 Author: Niane Mohamed · LinkedIn End-to-end exploitation chain of a critical CVSS 10.0 insecure deserialization vulnerability in React Server Components, from reconnaissance to...

10CVSS7.5AI score0.99802EPSS
SaveExploits391
Kitploit
Kitploit
added 2026/09/13 2:56 p.m.6 views

CVE-2017-11317-auto-exploit-

Vulnerabilities CVE-2017-11317 . https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference...

9.8CVSS8.3AI score0.84175EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/13 2:29 p.m.5 views

CVE-2025-50461

CVE-2025-50461: Remote Code Execution via Unsafe Model Deserialization in Verl Status: RESERVED This CVE ID has been assigned but is not yet published in the official CVE list. A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script whe...

6.5CVSS5.9AI score0.00496EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/13 2:25 p.m.5 views

CVE-2024-27674

CVE-2024-27674 Macro Expert icacls "C:\Program Files x86\GrassSoft\Macro Expert" C:\Program Files x86\GrassSoft\Macro Expert BUILTIN\Users:OICIM NT SERVICE\TrustedInstaller:IF NT SERVICE\TrustedInstaller:ICIIOF NT AUTHORITY\SYSTEM:IF NT AUTHORITY\SYSTEM:IOICIIOF BUILTIN\Administrators:IF...

7.8CVSS6.7AI score0.0031EPSS
SaveExploits0
Rows per page
Query Builder