CVE-2023-35078

CVE-2023-35078 shodan dorks You can use the following shodan dorks to find public targets. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs You can use the following to transform data from shodan API to format suitable for the checking script: root@kitploit: jq -cr...

exposecheck

EXPOSECHECK Only run against servers you own or are authorized to test. Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, ...

CVE-2012-1823

CVE-2012-1823 - PHP CGI Argument Injection Remote Code Execution RCE Severity: Critical CVSS 9.8 CVE: CVE-2012-1823 Published: May 11, 2012 Affected Software: PHP running in CGI mode php-cgi Vulnerability Type: Argument Injection / Remote Code Execution RCE Attack Vector: Network Authentication...

EUVD-2026-72556

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...

EUVD-2026-72560

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

EUVD-2026-72561

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

CVE-2022-22963

CVE-2022-22963 Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment. Overview CVE-2022-22963 is a Spring Cloud Function vulnerability involving the spring.cloud.function.routing-expression header. Under vulnerable configurations, a...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Cámara IP / DVR / NVR de Hikvision Autenticación incorrecta — Escalada de privilegios mediante un parámetro de consulta manipulado | ---|--- ID de CVE| CVE-2017-7921 Clase de vulnerabilidad| CWE-287: Autenticación incorrecta Puntuación base CVSS v3.0| 10.0 Crítico —...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-76977

SAP UI5 is affected by a clickjacking vulnerability in its Frame Options Allowlist mechanism. The framework does not sufficiently validate the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that bypasses framing restrictions. ...

CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

CVE-2026-76969

The @sap/cds-mtxs NPM library used in SAP Cloud Application Programming Model (CAP) multitenant applications with extensibility enabled does not perform sufficient checks on certain functionality, allowing an unauthenticated attacker to send specially crafted requests to obtain sensitive credenti...

CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

EUVD-2026-72586

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

EUVD-2026-72576

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767

CVE-2026-66767 is a memory corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an unauthenticated user to send a specially crafted packet triggering reprocessing of a previously buffered user request , potentially hijacking another user's session un...

CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

EUVD-2026-72575

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...