Lucene search
+L

10865 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.82 views

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

9.8CVSS8.2AI score0.97193EPSS
SaveExploits6References5
Kitploit
Kitploit
added 2026/09/20 1:27 a.m.8 views

CVE-2025-10720-PoC

Description This proof of concept PoC describes an authentication bypass vulnerability found in the WordPress plugin WP Private Content Plus v3.6.2. The issue allows unauthenticated users to bypass password-protected content due to improper reliance on client-side cookies. Details Vulnerability...

6.5CVSS5.8AI score0.00297EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/19 4:56 p.m.11 views

CVE-2025-9435

ADManager Plus Build 7230 Повышение привилегий CVE-2025-9435 Требования Пользователь-техник с ролью 'Modify user general properties' и доступом для входа на сервер, где установлен ADManager. Описание Если пользователь-техник имеет права входа на сервер, он может повысить свои привилегии до уровня...

5.5CVSS6.1AI score0.00602EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/19 3:22 p.m.9 views

CVE-2019-12541

CVE-2019-12541 XSS-уязвимость в Zoho ManageEngine ServiceDesk Plus 9.3 в SolutionSearch.do Описание проблемы: Проблема была обнаружена в Zoho ManageEngine ServiceDesk Plus 9.3. Существует XSS через параметр searchText в SolutionSearch.do. Автор: Concobe из Tarantula Team - VinCSS член Vingroup...

6.1CVSS6.4AI score0.10846EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/19 2:12 p.m.14 views

curveball-plus

curveball-plus эксперимент по моделированию атак Curveball CVE-2020-0601 с использованием неявных сертификатов ECQV и верификаторов, подобных Windows Этот файл постоянно обновляется!...

8.1CVSS7.5AI score0.89436EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/19 9:31 a.m.22 views

CP-PLUS-EZ-P21-CVE-2026-65893-65894

🔐 Анализ безопасности IP-камеры CP PLUS EZ-P21 CVE-2026-65893 CVE-2026-65894 Произвольное выполнение кода и некорректная аутентификация – IP-камера CP PLUS EZ-P21 Обзор В этом репозитории задокументированы две уязвимости, обнаруженные в IP-камере CP PLUS EZ-P21 — IP-камере видеонаблюдения,...

8.7CVSS6.6AI score0.004EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/19 3:17 a.m.11 views

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/19 2:36 a.m.13 views

CVE-2019-12538

CVE-2019-12538 Уязвимость XSS в Zoho ManageEngine ServiceDesk Plus 9.3 в SiteLookup.do Описание информации: В Zoho ManageEngine ServiceDesk Plus 9.3 обнаружена проблема. XSS возможен через параметр qcsiteID в SiteLookup.do. Автор: Concobe из Tarantula Team - VinCSS участник Vingroup Полезная...

6.1CVSS6.4AI score0.10846EPSS
SaveExploits5
CVE
CVE
added 2026/09/19 2:27 a.m.27 views

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

7.5CVSS0.00525EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/19 2:27 a.m.38 views

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/19 2:27 a.m.8 views

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

7.5CVSS0.00525EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/19 2:16 a.m.8 views

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus version 4.3.3 PoC for an authentication bypass on Windows 10. Affects all versions of Windows PoC Video Steps to repoduce 1. Disconnect from your enterprise network 2. Connect to your own hotspot 3. Click on reset password; the thick client...

7.2CVSS6.7AI score0.01413EPSS
SaveExploits2References1
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.105 views

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

9.8CVSS8.6AI score0.9896EPSS
SaveExploits8References5
Patchstack
Patchstack
added 2026/09/18 2:54 p.m.4 views

WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability

Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...

7.5CVSS0.00525EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/09/18 6:16 a.m.7 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/18 6:16 a.m.10 views

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

7.5CVSS0.01062EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/18 5:41 a.m.8 views

EUVD-2026-82656

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/18 5:41 a.m.37 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

7.7CVSS0.015EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/18 5:41 a.m.42 views

CVE-2026-18912

ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...

7.7CVSS0.015EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/18 5:37 a.m.9 views

EUVD-2026-82655

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

7.5CVSS0.01062EPSS
SaveExploits0References1
Rows per page
Query Builder