CVE-2026-78738

Silverpeas Core 6.4.6 is affected by a Cross-Site Scripting (XSS) vulnerability in the Document management file upload feature . An attacker can inject malicious scripts through uploaded documents that execute in the context of other users' sessions. A researcher has published technical details a...

PT-2026-86955

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

EUVD-2026-72910

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-48907

CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution RCE Severity: Critical CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – Improper Access Control Affected Software: Joomla Content Editor JCE Extension for Joomla Status: Publicly disclosed and actively exploited in the...

CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2026-86543

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. An unauthenticated attacker can access the /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publi...

CVE-2026-86543 knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 Exploit Title: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 Título del exploit: Vehicle Service Management System - 'Settings' Stored Cross Site Scripting XSS Autor del exploit: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIO Referencias: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Exploit Title: Vehicle Service Management System - 'Service Requests' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 Exploit Title: Vehicle Service Management System - 'MyAccount' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB Injection Vulnerability and Product description AhnLab EPP Management is a globally recognized next-generation advanced endpoint protection platform that integrates patch management, advanced malware detection, EDR, and XDR capabilities. NoSQLMongoDB Injection in was...

oracleShell

oracleShell Oracle Database Command Execution Test Environment - DBA Privileges: SELECT FROM v$version root@kitploit: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1...

CVE-2022-1388

Vuln Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. Vuln Product F5 BIG-IQ 11.6.1 - 11.6.5 F5 BIG-IP...

CVE-2024-0012

CVE-2024-0012 CVE-2024-0012 es una omisión de autenticación en el software PAN-OS de Palo Alto Networks que permite a un atacante no autenticado con acceso de red a la interfaz web de gestión obtener privilegios de administrador de PAN-OS para realizar acciones administrativas, manipular la...

CVE-2026-58455-PoC

CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass + command injection Proof-of-concept for CVE-2026-58455 : unauthenticated remote code execution in Dockwatch by Notifiarr, a self-hosted Docker container management web UI. Affects all versions through 0.6.567. Root cause verified from...

CVE-2026-80166

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges...

CVE-2021-42662

CVE-2021-42662 CVE-2021-42662 - Stored Cross-Site Scripting vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A stored XSS vulnerability exists in the Event management software version 2.3.0. An attacker can leverage this vulnerability in order...

milvus-auth-audit

milvus-auth-audit Milvus authentication security audit script. Detects three authentication flaws: Flaw| CVE| Affected versions| Detection method ---|---|---|--- sourceid backdoor auth bypass| CVE-2025-64513| --port 19530 --mgmt-port 9091 --internal-port 53100 Arguments: --host: Milvus proxy...

CVE-2026-80166

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this flaw to achieve elevation of privileges , ...