CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC WordPress用InfiniteWP Clientプラグイン（バージョン1.11.1以前）には、機密情報漏洩の脆弱性が存在します。この脆弱性により、購読者レベルの権限以上を持つ認証済み攻撃者が、設定詳細を含む機密データを抽出できる可能性があります。この脆弱性の悪用は、プラグインが事前に設定されていない場合にのみ可能です。別の任意のプラグインインストールおよび有効化の脆弱性と組み合わせると、サイトのリモート管理や権限昇格につながる可能性があります。...

CVE-2019-1653

CVE-2019-1653 Cisco Small Business RV320 および RV325 Dual Gigabit WAN VPN ルーターの Web ベース管理インターフェースにおける脆弱性により、認証されていないリモート攻撃者が機密情報を取得できる可能性があります。 このシンプルな Python スクリプトは、CVE-2019-1653 の自動エクスプロイトであり、Cisco Small Business RV320 および RV325 デバイスに感染します。悪用される最初の脆弱性は...

djangohunter

Djangohunter 旨在帮助识别错误配置的Django应用程序，这些应用程序正在暴露敏感信息。 https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en 使用方法 root@kitploit: Usage: python3 djangohunter.py --key shodan Dorks: 'DisallowedHost',...

CVE-2024-1209

CVE-2024-1209 LearnDashにおける課題経由の機密情報漏洩。認証されていない訪問者はアップロードされた課題を閲覧・ダウンロードできます。 脆弱性: CVE-2024-1209 課題経由の機密情報漏洩 CVSS: 5.3 Medium ソフトウェア: LearnDash sfwd-lms 影響を受けるバージョン: = 4.10.1 パッチ適用済みバージョン: 4.10.2 部分的に, 4.10.3 完全に 開発者: LearnDash 研究者: Karl Emil Nikka, Nikka Systems 公開日: 2024-02-05 最終更新日: 2024-02-05...

TCExam <= 14.8.1 - Sensitive Information Exposure

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. id: CVE-2021-20114 info: name: TCExam = 14.8.1 - Sensitive Information Exposure author: push4d severity:...

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

Jira - Local File Inclusion

Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion. id: CVE-2019-8442 info: name: Jira - Local File Inclusion author:...

LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure

The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.1 through the debug.log file that is publicly exposed. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

LearnPress < 4.2.7.4 - Course Material - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. id: CVE-2024-11868 info: name: LearnPress 4.2.7.4 -...

CVE-2025-22828

CVE-2025-22828 📜 설명 Apache CloudStack 4.16.0 이상 버전에는 리소스 UUID를 알고 있는 사용자가 접근 권한이 없는 리소스에 대해 댓글주석을 읽거나 추가할 수 있게 하는 손상된 접근 제어 문제가 있습니다. UUID는 사용자가 처음에 리소스에 접근할 수 있었지만 관리 제한으로 인해 나중에 접근 권한을 상실하는 경우 등 애플리케이션의 여러 부분에서 노출될 수 있습니다. 🔍 취약점 세부 정보 유형: 손상된 접근 제어 영향: 주석 및 잠재적으로 민감한 데이터에 대한 무단 접근 영향을 받는 버전:...

CVE-2024-9014

이 게시물은 EQSTLab에서 발행한 연구 기사입니다. CVE-2024-9014 ★ CVE-2024-9014 민감 정보 노출 PoC ★ 설명 CVE-2024-9014 : pgAdmin4 민감 정보 노출 설명: pgAdmin 8.11 및 이전 버전은 OAuth2 인증에 보안 결함이 있습니다. 이 취약점으로 인해 공격자가 클라이언트 ID와 시크릿을 획득하여 사용자 데이터에 무단 액세스할 수 있습니다. PoC 명령어 root@kitploit: curl URLTOTEST/login?next=/ | grep -o...

CVE-2024-1302---Badgermeter-moni-tool-Sensitive-information-exposure

CVE-2024-1302 --- Badgermeter moni tool - 민감한 정보 노출 https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1302: 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | CWE-200. 소프트웨어 링크 : https://www.s-can.at/en/product/monitool/ 버전 : 4.6.3...

CVE-2026-18887

IBM i 7.3 through 7.6 are affected by a sensitive information exposure vulnerability in the Portable Application Solutions Environment (PASE) , classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). An authenticated attacker with low privileges can access process info...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - 通过日志文件泄露敏感信息 root@kitploit: 描述： WordPress 插件 Cloud Templates & Patterns collection 在 1.2.2（含）及之前的所有版本中，因日志文件名称可预测而存在敏感信息泄露漏洞。未经身份验证的攻击者可以借此提取敏感数据。 严重性：中等 CVE ID: CVE-2023-47529 CVSS Score: 5.3 CVSS Metrics:...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache 平文保存の脆弱性 説明 CVE-2023-5359 は、WordPress プラグイン W3 Total Cache のバージョン ≤ 2.7.5 に影響する平文保存の脆弱性です。この脆弱性により、リモートの攻撃者は、公開されている暗号化されていない PHP ファイルに保存された機密の認証情報にアクセスできます。 深刻度 CVSS スコア : 7.5 高 ベクター : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N タイプ : 機密情報の露出 技術的な脆弱性 根本原因 W3 Total...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133

The Keep Backup Daily WordPress plugin (versions before 2.1.4 ) contains a sensitive information exposure vulnerability in the kbd_cron_process parameter. The parameter is publicly accessible without authentication, allowing an unauthenticated attacker over the network to trigger a full MySQL dat...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...