CVE-2026-76555

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 Script de detección de divulgación de información sensible de MinIO Uso root@kitploit: go mod tidy go build main.go ./main -u 'http://example.com'...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Sensitive File Disclosure vulnerability

Authenticated Sensitive File Disclosure vulnerability discovered by Hasyros in WordPress Plugin WP Import Export Lite versions 3.9.33...

CVE-2026-76555

The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) contains an authenticated sensitive file disclosure vulnerability via path traversal in its existing file import functionality. A user with the plugin's import permission (typically granted by an administrator) can supply an unv...

CVE-2022-31793

CVE-2022-31793 -u specify IP -l specify IP file -v verify mode -f specify file to read python poc.py -u ip -v python poc.py -l url.txt -v python poc.py -u ip -f /etc/hosts python poc.py -l url.txt -f /etc/hosts...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion is a rapid development platform for building and deploying web and mobile applications. CVE-2024-20767 - ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file syst...

CVE-2024-42992

CVE-2024-42992 Python Pip Pandas v2.2.2被发现包含一个任意文件 Pip Pandas（所有版本）-=2.2.2 “pandas”库中存在任意文件读取漏洞，攻击者可以利用该漏洞无限制地读取文件系统中的任何文件。此漏洞允许未经授权访问敏感文件，如“/etc/passwd” pandas库提供了强大的数据操作能力，包括从各种文件格式读取数据的能力。但是，它对作为输入提供的文件路径缺乏足够的限制，使得恶意用户能够指定和读取任意文件。 可以通过以下代码片段来演示该漏洞: root@kitploit: import pandas as pd Attempt to...

EUVD-2026-80060

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

CVE-2023-40028

Prueba de Concepto PoC para CVE-2023-40028 CVE-2023-40028 es una vulnerabilidad en Ghost CMS que permite la lectura arbitraria de archivos mediante un manejo inadecuado de archivos. Esta PoC demuestra cómo funciona el exploit en condiciones controladas. Solo con fines educativos. Referencia:...

CVE-2026-91744

A flaw was found in Google Chrome. A race condition in the PlatformIntegration component could allow a remote attacker, who has compromised the renderer process and leveraged social engineering, to obtain sensitive information. This can occur when a user visits a specially crafted HTML page...

CVE-2026-76871

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...

CVE-2026-76859

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...

CVE-2026-76857

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

CVE-2026-91717

A flaw was found in Google Chrome on Android. This missing authorization vulnerability allows a local attacker, through a co-installed application, to obtain sensitive information. This could lead to unauthorized access to user data...

CVE-2023-5359

CVE-2023-5359 - Vulnerabilidad de almacenamiento en texto claro en W3 Total Cache Descripción CVE-2023-5359 es una vulnerabilidad de almacenamiento en texto claro que afecta al plugin de WordPress W3 Total Cache en versiones ≤ 2.7.5. Esta vulnerabilidad permite a atacantes remotos acceder a...

CVE-2026-76863 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their...

CVE-2026-76863

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling, specifically within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access QoS read routes to obtain live network telemetry...

CVE-2026-76859 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

DEBIAN-CVE-2026-91744

Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...