Lucene search
+L

481 matches found

Kitploit
Kitploit
added 2026/09/16 3:13 p.m.9 views

CVE-2021-41773S

CVE-2021-41773 Apache 路径遍历漏洞的易受攻击 Docker 镜像 该漏洞 仅 适用于具有特定非默认配置的 2.4.49 版本。在某些情况下,这可能导致文件读取或代码执行。 https://twitter.com/ptswarm/status/1445376079548624899 可造成文件读取的漏洞配置 可直接从 Docker Hub 拉取容器 docker pull blueteamsteve/cve-2021-41773:no-cgid 并使用以下命令执行 docker run -dit -p 8080:80...

9.8CVSS8.2AI score0.99992EPSS
SaveExploits165
Kitploit
Kitploit
added 2026/09/16 6:22 a.m.14 views

CVE-2019-0232

CVE-2019-0232 漏洞利用 CGI Servlet 远程代码执行 RCE – Windows上的Apache Tomcat 参考 : https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ root@kitploit: Apache Tomcat在CGI...

9.3CVSS7.9AI score0.99652EPSS
SaveExploits11
EUVD
EUVD
added 2026/09/15 8:21 p.m.6 views

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

1.8CVSS5.7AI score0.00309EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/14 6:11 p.m.12 views

CVE-2020-35590

漏洞利用信息 漏洞标题: WordPress 插件 Limit Login Attempts Reloaded 2.13.0 - 登录限制绕过 CVE: CVE-2020-35590 日期: 2020-06-09 漏洞作者: N4nj0 软件链接: https://wordpress.org/plugins/limit-login-attempts-reloaded/ 版本: 2.13.0 测试环境: WordPress 5.4.1, 5.4.2 漏洞公告:...

9.8CVSS8.1AI score0.04348EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/14 2:08 p.m.7 views

CVE-2021-41773

针对 CVE-2021-41773 Apache 路径遍历漏洞的易受攻击的 Docker 镜像 该漏洞 仅 适用于具有特定非默认配置的 2.4.49 版本。在某些情况下,这可能导致文件读取或代码执行。 https://twitter.com/ptswarm/status/1445376079548624899 易受攻击的文件读取配置 容器可以直接从 Docker Hub 拉取,使用 docker pull blueteamsteve/cve-2021-41773:no-cgid 并执行 docker run -dit -p 8080:80...

9.8CVSS8.2AI score0.99992EPSS
SaveExploits165
CVE
CVE
added 2026/09/02 6:00 a.m.14 views

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin (before 3.0.1 ) contains a Reflected Cross-Site Scripting vulnerability via the Pin It Share Handler . The root cause is a failure to properly escape a value taken from the incoming request before outputting it in an inline Ja...

7.1CVSS5.8AI score0.0018EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/01 5:17 a.m.9 views

CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsddisplstyle' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible f...

7.2CVSS0.00241EPSS
SaveExploits0References6
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in OpenSSL

Issue Summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact Summary: Attackers may exploit certain server configurations to trigger unbounded memory growth, leading to a Denial of Service attack. This issue can occur in...

5.9CVSS6.5AI score0.54026EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.16 views

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 6.2 through 8.x, prior to version 8.8, when certain non-default configurations were used, privilege escalation could occur because supplementary groups were not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand might run with privileges...

7CVSS7.3AI score0.02545EPSS
SaveExploits2References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.6 views

Astra Linux – Vulnerability in OpenSSL

Applications that use non-default options when verifying certificates may be vulnerable to attacks from a malicious Certificate Authority CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL, and other certificate policy checks for tho...

5.3CVSS6.6AI score0.01583EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/13 4:05 p.m.36 views

CVE-2026-55400

CVE-2026-55400 describes an integer underflow in Secure Access servers prior to 14.57. With an authenticated session, an attacker can send specially crafted traffic to a server in a non-default configuration, causing a persistent denial of service. Affected product/version: Secure Access servers

6.5CVSS5.3AI score0.0026EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/08/11 12:19 a.m.109 views

CVE-2026-66774

SAP Approuter in SAP Business AI Platform contains multiple vulnerabilities related to error handling under non-default configurations. An attacker with low privileges could exploit conditions outside their control to affect availability , with no impact on confidentiality or integrity reported. ...

3.7CVSS5.3AI score0.00222EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/08/11 12:19 a.m.14 views

EUVD-2026-55886

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...

3.7CVSS5.3AI score0.00222EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/05 8:48 p.m.16 views

rclone: Local Encoding Path Traversal

Summary The local backend relies on its configurable filename encoder to prevent remote filename data from becoming operating-system path syntax. If a local destination uses an encoding that omits Dot, such as Slash, None, or Raw, a remote object's standard-encoded .. component is decoded into an...

6.9CVSS6.1AI score0.00298EPSS
SaveExploits0References4Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/08/05 12:00 a.m.16 views

Linux Distros Unpatched Vulnerability : CVE-2026-71192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...

6CVSS5.8AI score0.00292EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/04 6:00 a.m.55 views

CVE-2026-16296 Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

0.00187EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:00 a.m.21 views

EUVD-2026-52598

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

4.7CVSS5.6AI score0.00187EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/01 6:00 a.m.19 views

EUVD-2026-51717

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

5.6AI score0.00226EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/01 6:00 a.m.9 views

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

5.6AI score0.00226EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/01 6:00 a.m.49 views

CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

0.00226EPSS
SaveExploits0References1
Rows per page
Query Builder