Lucene search
+L

481 matches found

Kitploit
Kitploit
added 2026/09/16 3:13 p.m.9 views

CVE-2021-41773S

Vulnerable docker images for CVE-2021-41773 Apache path traversal This vulnerabiltiy only applies to version 2.4.49 that have specific non-default configs. In certain situations this can result in either file read or code execution. https://twitter.com/ptswarm/status/1445376079548624899 Vulnerabl...

9.8CVSS8.2AI score0.99992EPSS
SaveExploits165
Kitploit
Kitploit
added 2026/09/16 6:22 a.m.14 views

CVE-2019-0232

CVE-2019-0232 Exploit Remote Code Execution RCE in CGI Servlet – Apache Tomcat on Windows Refference : https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ root@kitploit: Apache Tomcat has a vulnerability in the CGI...

9.3CVSS7.9AI score0.99652EPSS
SaveExploits11
EUVD
EUVD
added 2026/09/15 8:21 p.m.6 views

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

1.8CVSS5.7AI score0.00309EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/14 6:11 p.m.12 views

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

9.8CVSS8.1AI score0.04348EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/14 2:08 p.m.7 views

CVE-2021-41773

Imágenes Docker vulnerables para CVE-2021-41773 Apache path traversal Esta vulnerabilidad solo aplica a la versión 2.4.49 que tiene configuraciones específicas no predeterminadas. En ciertas situaciones, esto puede resultar en lectura de archivos o ejecución de código...

9.8CVSS8.2AI score0.99992EPSS
SaveExploits165
CVE
CVE
added 2026/09/02 6:00 a.m.14 views

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin (before 3.0.1 ) contains a Reflected Cross-Site Scripting vulnerability via the Pin It Share Handler . The root cause is a failure to properly escape a value taken from the incoming request before outputting it in an inline Ja...

7.1CVSS5.8AI score0.0018EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/01 5:17 a.m.9 views

CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsddisplstyle' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible f...

7.2CVSS0.00241EPSS
SaveExploits0References6
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in OpenSSL

Issue Summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact Summary: Attackers may exploit certain server configurations to trigger unbounded memory growth, leading to a Denial of Service attack. This issue can occur in...

5.9CVSS6.5AI score0.54026EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.16 views

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 6.2 through 8.x, prior to version 8.8, when certain non-default configurations were used, privilege escalation could occur because supplementary groups were not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand might run with privileges...

7CVSS7.3AI score0.02545EPSS
SaveExploits2References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.6 views

Astra Linux – Vulnerability in OpenSSL

Applications that use non-default options when verifying certificates may be vulnerable to attacks from a malicious Certificate Authority CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL, and other certificate policy checks for tho...

5.3CVSS6.6AI score0.01583EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/13 4:05 p.m.36 views

CVE-2026-55400

CVE-2026-55400 describes an integer underflow in Secure Access servers prior to 14.57. With an authenticated session, an attacker can send specially crafted traffic to a server in a non-default configuration, causing a persistent denial of service. Affected product/version: Secure Access servers

6.5CVSS5.3AI score0.0026EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/08/11 12:19 a.m.109 views

CVE-2026-66774

SAP Approuter in SAP Business AI Platform contains multiple vulnerabilities related to error handling under non-default configurations. An attacker with low privileges could exploit conditions outside their control to affect availability , with no impact on confidentiality or integrity reported. ...

3.7CVSS5.3AI score0.00222EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/08/11 12:19 a.m.14 views

EUVD-2026-55886

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...

3.7CVSS5.3AI score0.00222EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/05 8:48 p.m.16 views

rclone: Local Encoding Path Traversal

Summary The local backend relies on its configurable filename encoder to prevent remote filename data from becoming operating-system path syntax. If a local destination uses an encoding that omits Dot, such as Slash, None, or Raw, a remote object's standard-encoded .. component is decoded into an...

6.9CVSS6.1AI score0.00298EPSS
SaveExploits0References4Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/08/05 12:00 a.m.16 views

Linux Distros Unpatched Vulnerability : CVE-2026-71192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...

6CVSS5.8AI score0.00292EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/04 6:00 a.m.55 views

CVE-2026-16296 Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

0.00187EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:00 a.m.21 views

EUVD-2026-52598

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

4.7CVSS5.6AI score0.00187EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/01 6:00 a.m.19 views

EUVD-2026-51717

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

5.6AI score0.00226EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/01 6:00 a.m.9 views

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

5.6AI score0.00226EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/01 6:00 a.m.49 views

CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

0.00226EPSS
SaveExploits0References1
Rows per page
Query Builder