CVE-2018-14847

WinboxExploit Esta es una prueba de concepto de la vulnerabilidad crítica de WinBox CVE-2018-14847 que permite la lectura arbitraria de archivos de contraseñas en texto plano. Publicación del blog https://n0p.me/winbox-bug-dissection/ Requisitos Python 3+ Este script NO se ejecutará con Python 2....

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Divulgation d'informations sensibles via le firmware de la mémoire flash SPI pour le routeur Hathway - CVE-2024-46383 Description de la vulnérabilité : Lors de l'évaluation de sécurité du firmware du routeur, il a été observé que les informations sensibles concernant les appareils connectés au...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extraindo-Credenciais-de-Usuário-para-Roteador-Hathway Via SPI flash-CVE-2024-44815 Descrição da Vulnerabilidade: Durante a avaliação de segurança do firmware do roteador, observou-se que as credenciais de login do roteador, tanto do portal web quanto do ponto de acesso Wi-Fi, são armazenadas em...

CVE-2022-42176

PCSecure V5.0.8.xw - استخدام بيانات اعتماد مضمّنة في ملفات الإعداد يؤدي إلى الوصول إلى لوحة الإدارة الملخص البائع: PCTechSoft SAS المنتج: PCSecure الإصدار الإصدارات المتأثرة: 5.0.8.xw الاسم الرمزي: PapiQuieroPollo00 الثغرة النوع: استخدام بيانات اعتماد مضمّنة CWE-798 متجه CVSSv3.1:...

smb

root@kitploit: ███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB es un protocolo de red que permite compartir archivos,...

ctf

Cose relative al CTF Indice Le sfide sono collegate nella tabella seguente. Descrizione| Evento/Gioco| Soluzione ---|---|--- Smash The Stack| ---| --- Blackbox| Level 1| Un eseguibile con una funzionalità di "login" con la password in testo semplice nella memoria. Blackbox| Level 2| Un eseguibile...

CVE-2025-63820

CVE-2025-63820 Einreicher: Nicola Giuffrida Informationen Hersteller: TOTOLINK Website des Herstellers: TOTOLINK Modell: A720R Firmware-Version: V4.1.5cu.630B20250509 Firmware-Downloadadresse: TOTOLINK Details zur Schwachstelle Beim Anmelden am Kontrollpanel werden Benutzername und Passwort im...

WinboxPoC

WinboxExploit Questa è una proof of concept della critica vulnerabilità WinBox CVE-2018-14847 che consente la lettura arbitraria di file con password in chiaro. La vulnerabilità è stata riparata da tempo, quindi questo progetto è terminato e non sarà più supportato o aggiornato. Puoi invece...

CVE-2026-5076

CVE-2026-5076 - ARMember Schwachstelle beim Zurücksetzen des Passworts Informationen zur Schwachstelle Element| Detail ---|--- CVE-ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Betroffene Version| Premium = 7.3.1 Gepatchte Version| 7.3.2 CVSS-Score| 9.8 Kritisch CWE...

solutions

Exploitmatic solutions !License: Apache 2.0https://img.sh...

CVE-2026-54433

CVE-2026-54433: XSS memorizzato nelle email in testo semplice di Roundcube Questo repository contiene una prova di concetto Python configurabile per CVE-2026-54433 , una vulnerabilità di cross-site scripting memorizzato nel renderer di email in testo semplice di Roundcube. Un mittente non...

Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2026-54433: Roundcube plain-text email stored XSS !Explo...

CVE-2026-18097

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

Security Bulletin: IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. (CVE-2026-18097)

Summary IBM® Db2® could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. Vulnerability Details CVEID:CVE-2026-18097 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain...

Millions of cars could be tracked and unlocked by a hidden security flaw

A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187 Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

EUVD-2026-47653

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

The CVE-2026-44187 vulnerability affects the Ansible Lightspeed extension for Visual Studio Code. It allows a local attacker or malware operating with the user’s privileges to read the Google Gemini API key because the extension stores the credential in plaintext in the user’s configuration file ...