Lucene search
+L

128545 matches found

CVE
CVE
added 2026/09/11 7:14 p.m.84 views

CVE-2026-78546

CVE-2026-78546 is an Out-of-Bounds Read (CWE-125) in the Citrix Workspace app for Windows . It requires local access and low privileges, with no user interaction needed. The CVSS v4.0 base score is 4.8 (Medium) , reflecting low impacts to both confidentiality and availability. Affected versions i...

4.8CVSS5.7AI score0.00149EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/11 6:20 p.m.33 views

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

5.9CVSS0.00251EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 5:55 p.m.14 views

CVE-2024-23897

CVE-2024-23897 — HTTPS + CSRF-crumb aware PoC cve-2024-23897-crumb.py — unauthenticated arbitrary file read against Jenkins = 2.441 / LTS = 2.426.2 fixed in 2.442 / LTS 2.426.3. What this adds over the public PoCs The widely-used PoCs — exploit-db 51993, xaitax/CVE-2024-23897, and the...

9.8CVSS8.4AI score0.99999EPSS
SaveExploits50References2
Kitploit
Kitploit
added 2026/09/11 5:54 p.m.28 views

CVE-2026-23751-poc

CVE-2026-23751-PoC Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture. CVE-2026-23751 Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET...

9.8CVSS6.2AI score0.00883EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 5:26 p.m.9 views

ESCepcion

🛡️ ESCepcion Active Directory Certificate Services Auditor ESCepcion is an open-source tool for auditing and assessing vulnerabilities in Active Directory Certificate Services AD CS infrastructures. It is designed to automate the detection of privilege escalation paths ESC with a strict focus on...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 5:18 p.m.7 views

CyBroHttpServer-v1.0.3-Directory-Traversal

CyBroHttpServer-v1.0.3-Directory-Traversal Directory Traversal in CyBroHttpServer v1.0.3 allows an attacker to read sensitive informations. CVE-2018-16133 https://vulners.com/cve/CVE-2018-16133 PoC To exploit vulnerability, someone could use 'http://host/../../../../../../../../' request to get...

5.3CVSS6.2AI score0.39279EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/11 4:51 p.m.9 views

CVE-2025-10952-ml-logger-AFR

CVE-2025-10952 — ml-logger streamhandler Arbitrary File Read This repository provides a standalone Python script — CVE-2025-10952.py — that exploits an unauthenticated arbitrary file read vulnerability in ml-logger's streamhandler, chained with the /glob endpoint for filesystem enumeration. When...

6.9CVSS6.2AI score0.00369EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/11 4:47 p.m.11 views

cgiemail-exploit

Cgiemail - Source Code Disclosure/Local File Inclusion Exploit cgiecho a script included with cgiemail will return any file under a websites document root if the file contains square brackets and the text within the brackets is guessable. cgiemail is currently shipped with cPanel, enabled by...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/11 4:34 p.m.8 views

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — CyberPanel AI Scanner Unauthenticated Read/Write API Access Nuclei detection template for CVE-2026-41473 affecting CyberPanel versions before 2.4.4. Vulnerability CyberPanel's AI Scanner feature exposes two API endpoints without authentication:...

9.1CVSS5.8AI score0.00793EPSS
SaveExploits1
The Hacker News
The Hacker News
added 2026/09/11 4:30 p.m.11 views

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 CVSS score: 10.0, a path traversal issue in the repository commits AP...

10CVSS7.7AI score0.11957EPSS
SaveExploits10
GithubExploit
GithubExploit
added 2026/09/11 4:18 p.m.39 views

Exploit for CVE-2026-85706

CVE-2026-85706: GitLab CE/EE allows arbitrary file reading wit...

8.4AI score0.11957EPSS
SaveExploits10
NVD
NVD
added 2026/09/11 4:17 p.m.8 views

CVE-2026-89260

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

8.7CVSS0.00425EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/11 4:17 p.m.9 views

CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

8.7CVSS0.00373EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/11 4:03 p.m.11 views

CVE-2025-7401

CVE-2025-7401 Premium Age Verification / Restriction for WordPress = 3.0.2 - Lectura y escritura arbitraria de archivos no autenticada 🧾 Premium Age Verification / Restriction for WordPress = 3.0.2 — Lectura y escritura arbitraria de archivos no autenticada 📝 Descripción El plugin "Premium Age...

9.8CVSS6AI score0.00546EPSS
SaveExploits2
GithubExploit
GithubExploit
added 2026/09/11 3:58 p.m.23 views

Exploit for CVE-2026-85706

CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local f...

8.4AI score0.11957EPSS
SaveExploits10
CVE
CVE
added 2026/09/11 3:54 p.m.28 views

CVE-2026-89013

Dolibarr (ERP/CRM) versions 23.0.4 before 24.0.1 contains an authorization bypass in its document storage endpoints (htdocs/document.php and htdocs/viewimage.php). By sending a request with the crafted parameter hashp=shared , an unauthenticated attacker can skip token validation while still sati...

8.7CVSS5.9AI score0.00373EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/11 3:37 p.m.10 views

rails-activestorage-vips-audit

rails-activestorage-vips-audit An Agent Skill that audits Ruby on Rails repositories for exposure to CVE-2026-66066 KindaRails2Shell — the Active Storage libvips variant-processing vulnerability that allows arbitrary file read and, in a Rails application, remote code execution. The skill is a...

9.5CVSS8.8AI score0.27861EPSS
SaveExploits10
EUVD
EUVD
added 2026/09/11 3:25 p.m.8 views

EUVD-2026-76133

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

8.7CVSS6AI score0.00425EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/11 3:25 p.m.37 views

CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

8.7CVSS0.00425EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/11 3:25 p.m.22 views

CVE-2026-89260

MoguBlog through 6.2 is affected by an XML External Entity (XXE) injection in the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck . The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap() , which relies on an unhardened dom4j SAXReader without DTD ...

8.7CVSS6AI score0.00425EPSS
SaveExploits0References6
Rows per page
Query Builder