CVE-2025-505050

CVE-2025- Descripción: acceso no autenticado a archivos subidos POC: navegue a cualquier archivo subido y se accederá sin necesidad de iniciar sesión Descubierto por Aljohara Abdulmohsen Alsubaie...

CVE-2024-1207

Booking Calendar = 9.9 - Inyección SQL no autenticada CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection Prueba de concepto: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com...

CVE-2023-5359

CVE-2023-5359 - Vulnerabilidad de almacenamiento en texto claro en W3 Total Cache Descripción CVE-2023-5359 es una vulnerabilidad de almacenamiento en texto claro que afecta al plugin de WordPress W3 Total Cache en versiones ≤ 2.7.5. Esta vulnerabilidad permite a atacantes remotos acceder a...

CVE-2020-9496

CVE-2020-9496 Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. Affected Version 17.12....

CVE-2026-83368

CVE-2026-83368 affects the Compiler component of Oracle GraalVM for JDK , Oracle GraalVM Enterprise Edition , and Oracle GraalVM (Oracle Java SE). Affected versions include Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1), Oracle GraalVM Enterprise Edition (21.3.19.1),...

CVE-2026-83408

CVE-2026-83408 affects the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM (part of Oracle Java SE). Affected supported versions are GraalVM for JDK 17: 23.0.13.1, GraalVM for JDK 21: 23.1.12.1, and GraalVM: 25.0.4.1. The vulnerability allows an unauthenticated attacker with netwo...

CVE-2026-83357

Oracle GraalVM for JDK / Oracle GraalVM (Oracle Java SE, component: Compiler ) contains a vulnerability in affected supported versions: GraalVM for JDK 17 (23.0.13.1), GraalVM for JDK 21 (23.1.12.1), and GraalVM 25.0.4.1. An unauthenticated attacker with network access via HTTP can exploit this f...

CVE-2026-82567

mySCADA myPRO Manager exposes an unauthenticated HTTP endpoint in its notification gateway that accepts a phone number and message to send SMS via a connected GSM modem. Because no credentials are required, any attacker with adjacent network access can trigger arbitrary SMS messages through the d...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-73807

mySCADA myPRO Manager has a missing authorization vulnerability in its command API , which fails to properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API can reach privileged management functions, rated CVSS 3.1 9.8 (Critical...

CVE-2026-73807 mySCADA myPRO Manager Missing Authorization

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Inclusión de archivos locales no autenticada 📝 Descripción El complemento Kubio AI Page Builder para WordPress es vulnerable a la inclusión de archivos locales en todas las versiones hasta la 2.5.1 incluida, a través de la función kubiohybridthemeloadtemplate. Es...

CVE-2025-3102

🔐 CVE-2025-3102 – Omisión de Autenticación en el Plugin SureTriggers de WordPress 🚨 CVE-2025-3102 es una vulnerabilidad crítica de omisión de autenticación que afecta al plugin de WordPress SureTriggers: All-in-One Automation Platform , el cual está instalado activamente en más de 100,000 sitios...

cve-2024-10914-port

CVE-2024-10914 portado a rust y python porque sí qué es esto cve-2024-10914 es una vulnerabilidad descubierta recientemente con una puntuación crítica de 9.8 que afecta a algunos routers dlink. como esos routers llegaron a su fin de vida útil EOL, dlink se niega a parchear esta vulnerabilidad...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Ejecución Arbitraria de Shortcodes CVE-2024-10958 Código PoC para la vulnerabilidad de ejecución arbitraria de shortcodes sin autenticación en el plugin WordPress WP Photo Album Plus. Detalles Versiones Afectadas: = 8.8.08.007 Puntuación CVSS: 7.3 Alta Tipo de...

CVE-2026-88065

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-68953

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication

CVE-2026-22017 – Actualización de firmware vía BLE sin autenticación Código del programa periférico Python bleak root@kitploit: blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: de...

CVE-2026-61554

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

CVE-2026-54544

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...