CVE-2019-1653

CVE-2019-1653 Una vulnerabilidad en la interfaz de administración basada en web de los routers Cisco Small Business RV320 y RV325 Dual Gigabit WAN VPN podría permitir que un atacante remoto no autenticado recupere información sensible. Este script simple de Python es una automatización de exploit...

djangohunter

Djangohunter 旨在帮助识别错误配置的Django应用程序，这些应用程序正在暴露敏感信息。 https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en 使用方法 root@kitploit: Usage: python3 djangohunter.py --key shodan Dorks: 'DisallowedHost',...

CVE-2024-1209

CVE-2024-1209 通过LearnDash中的作业泄露敏感信息。未经认证的访问者可以浏览和下载上传的作业。 漏洞: CVE-2024-1209 通过作业泄露敏感信息 CVSS: 5.3 中等 软件: LearnDash sfwd-lms 受影响版本: = 4.10.1 补丁版本: 4.10.2 部分, 4.10.3 完全 开发者: LearnDash 研究员: Karl Emil Nikka, Nikka Systems 公开发布: 2024-02-05 最后更新: 2024-02-05 概述...

CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 and later versions have a broken access control issue that allows users with knowledge of resource UUIDs to read or add comments annotations on resources they are not authorized to access. UUIDs can be exposed in various parts of the...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

CVE-2024-1302---Badgermeter-moni-tool-Sensitive-information-exposure

CVE-2024-1302 --- Badgermeter moni tool - 敏感信息泄露 https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1302: 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | CWE-200. 软件链接 : https://www.s-can.at/en/product/monitool/ 版本 : 4.6.3 @作者 :...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC WordPress 的 InfiniteWP Client 插件（版本至 1.11.1 及包括该版本）存在敏感信息泄露漏洞。该漏洞允许具有订阅者级别或更高权限的已认证攻击者提取包含配置详细信息在内的敏感数据。利用此漏洞的前提是插件尚未进行过配置。当与另一个任意插件安装和激活漏洞结合使用时，可能导致对站点的远程管理以及潜在的权限提升。...

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

TCExam <= 14.8.1 - Sensitive Information Exposure

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. id: CVE-2021-20114 info: name: TCExam = 14.8.1 - Sensitive Information Exposure author: push4d severity:...

Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

LearnPress < 4.2.7.4 - Course Material - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. id: CVE-2024-11868 info: name: LearnPress 4.2.7.4 -...

CVE-2026-18887

IBM i 7.3 through 7.6 are affected by a sensitive information exposure vulnerability in the Portable Application Solutions Environment (PASE) , classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). An authenticated attacker with low privileges can access process info...

Jira - Local File Inclusion

Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion. id: CVE-2019-8442 info: name: Jira - Local File Inclusion author:...

LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure

The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.1 through the debug.log file that is publicly exposed. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - 通过日志文件泄露敏感信息 root@kitploit: 描述： WordPress 插件 Cloud Templates & Patterns collection 在 1.2.2（含）及之前的所有版本中，因日志文件名称可预测而存在敏感信息泄露漏洞。未经身份验证的攻击者可以借此提取敏感数据。 严重性：中等 CVE ID: CVE-2023-47529 CVSS Score: 5.3 CVSS Metrics:...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache 明文存储漏洞 描述 CVE-2023-5359 是一个影响 WordPress 插件 W3 Total Cache （版本 ≤ 2.7.5）的明文存储漏洞。该漏洞允许远程攻击者访问存储在未加密且可公开访问的 PHP 文件中的敏感凭据。 严重性 CVSS 评分 : 7.5 高危 向量 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 类型 : 敏感信息泄露 技术漏洞 根本原因 W3 Total Cache 将配置设置和 API 凭据存储在...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133

The Keep Backup Daily WordPress plugin (versions before 2.1.4 ) contains a sensitive information exposure vulnerability in the kbd_cron_process parameter. The parameter is publicly accessible without authentication, allowing an unauthenticated attacker over the network to trigger a full MySQL dat...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...