Lucene search
+L

24282 matches found

Kitploit
Kitploit
added 2026/09/15 10:00 a.m.8 views

CVE-2026-35273

🚨 CVE-2026-35273 - Ejecución Remota de Código Sin Autenticación en Oracle PeopleSoft PeopleTools ⚠️ RCE Crítica Sin Autenticación en Oracle PeopleSoft PeopleTools Una vulnerabilidad que afecta a Oracle PeopleSoft Enterprise PeopleTools y permite a atacantes remotos comprometer sistemas vulnerables...

9.8CVSS8.2AI score0.95473EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/15 9:17 a.m.5 views

CVE-2021-38647-noimages

CVE-2021-38647 AKA "OMIGOD" A Zeek package which detects CVE-2021-38647 AKA OMIGOD exploit attempts. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647...

9.8CVSS7.4AI score0.99933EPSS
SaveExploits19
Kitploit
Kitploit
added 2026/09/15 8:51 a.m.5 views

CVE-2026-51119

CVE-2026-51119 - Escalada de Privilegios en Invixium IXM WEB v2.3.85.25 Descripción General Existe una vulnerabilidad de escalada de privilegios en Invixium IXM WEB v2.3.85.25 debido a la falta de comprobaciones de autorización en el endpoint POST /SystemUsers/CreateAppUser. Un usuario autenticad...

9.1CVSS6AI score0.00538EPSS
SaveExploits0
CVE
CVE
added 2026/09/15 8:36 a.m.5 views

CVE-2026-91846

MISP (≤2.5.45) contains a missing authorization check when adding collection elements from a bare UUID. Because collection elements only store UUIDs that are resolved later by the collection view, the generic add() path could persist a UUID for an Event or Galaxy Cluster that the acting user coul...

7.1CVSS0.00207EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 8:36 a.m.5 views

CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

7.1CVSS0.00207EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 8:26 a.m.6 views

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

8.8CVSS7.8AI score0.01426EPSS
SaveExploits1References1
CVE
CVE
added 2026/09/15 8:06 a.m.6 views

CVE-2026-91825

MISP versions ≤2.5.45 contain an authorization bypass in the event-edit path. When a request supplied a non-empty sharing_group_id but omitted the distribution field , the authorization check (which only fired for distribution = 4) was skipped. MISP's field-recovery logic then restored the existi...

7.1CVSS0.00243EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 7:17 a.m.11 views

SAP_RECON

PoC for CVE-2020-6287, CVE-2020-6286 SAP RECON vulnerability Pffff! RECON Remotely Exploitable Code On NetWeaver? Guys, really? That was the best codename you came up with? : This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and as a PoC script...

10CVSS7.4AI score0.94719EPSS
SaveExploits7
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.29 views

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

9.8CVSS8.1AI score0.06691EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.41 views

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

7.3CVSS6.9AI score0.01084EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.15 views

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

8.7CVSS7.9AI score0.01283EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.70 views

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

5.3CVSS5.9AI score0.04213EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.24 views

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

7.3CVSS5.8AI score0.00588EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.54 views

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

8.8CVSS7.8AI score0.01504EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.8 views

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. id: CVE-2026-81199 info:...

5.3CVSS0.00302EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.5 views

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

10CVSS0.00907EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.20 views

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

5.3CVSS5.9AI score0.01142EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/15 4:23 a.m.8 views

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

7.5CVSS8.1AI score0.01624EPSS
SaveExploits6References1
Kitploit
Kitploit
added 2026/09/15 1:42 a.m.7 views

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

9.8CVSS5.9AI score0.04156EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/15 1:20 a.m.6 views

EUVD-2026-78250

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS0.00199EPSS
SaveExploits0References5
Rows per page
Query Builder