32531 matches found
WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by 0xzenko in WordPress Plugin Vimeo versions = 1.2.2...
ListingPro < 2.6.1 - Sensitive Data Disclosure Detection
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...
Fanwei e-cology - SQL Injection Detection
Fanwei e-cology 8.0 contains a sql injection caused by unsanitized user input in the sql parameter of getdata.jsp, letting unauthenticated attackers execute arbitrary SQL queries and access sensitive data. !/usr/bin/env python3 -- coding: utf-8 -- """Fanwei e-cology 8.""" from kittysploit import...
Bitbucket Server > 4.8 - Authentication Bypass Detection
There is a permission bypass vulnerability through %20, which allows arbitrary users to obtain sensitive data !/usr/bin/env python3 -- coding: utf-8 -- """There is a permission bypass vulnerability through %20, which allows arbitrary users to obtain sensitive data.""" from kittysploit import from...
Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure Detection
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code !/usr/bin/env python3 -- coding: utf-8 -- """The Quttera Web Malware Scanner WordPress plugin befor...
Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure Detection
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...
HIKVISION iSecure Center - Remote Code Execution Detection
Hikvision's comprehensive security management platform has a Fastjson remote command execution vulnerability, which can execute system commands and obtain system permissions and sensitive data information of the target server. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision's comprehensive...
perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery Detection
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery SSRF attacks. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in the graphData.""" from kittysploit import from lib.protocols.http.httpclie...
Glimpse Diagnostics - Sensitive Data Exposure Detection
Detected Glimpse diagnostics endpoint. Glimpse is a .NET diagnostics tool that reveals detailed request information, server configuration, SQL queries, connection strings, and session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Glimpse diagnostics endpoint.""" from kittysploit...
CVE-2026-58331
A flaw was found in the Moodle Database Activity module. This vulnerability allows an attacker to perform an arbitrary file read through the module's import feature. This could lead to the disclosure of sensitive information from the system...
BIT-ELK-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...
EUVD-2026-49640
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
EUVD-2021-34858
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...
PT-2026-65591
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...
PT-2026-65597
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
PT-2026-65566
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...
PT-2026-65593
Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through 6.2.2.0 1 IBM Sterling File Gateway versions 6.2.0.0 through...
PT-2026-65592
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5 2, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5 2, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 stores potentially sensitive information in log files that could be rea...
PT-2026-65594
Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through 6.2.2.0 1 IBM Sterling File Gateway versions 6.2.0.0 through...
