Lucene search
+L

119962 matches found

Kitploit
Kitploit
added 2026/08/31 12:18 p.m.4 views

CVE-2017-7921-EXPLOIT

CVE-2017-7921 - Vulnerabilidad de Autenticación Inadecuada en la Serie de Cámaras Hikvision Una falla de seguridad identificada como CVE-2017-7921 que afecta a varios modelos de cámaras Hikvision. La vulnerabilidad fue descubierta en los dispositivos de las series DS-2CD2xx2F-I V5.2.0 build 14072...

9.8CVSS7.3AI score0.99998EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/08/31 12:09 p.m.2 views

NextSploit

🔍 NextSploit: Next.js CVE-2025-29927 Scanner & Exploiter ⚠️ NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927 , a security flaw in Next.js. The tool first identifies if a target website is running Next.js and determines whether its version falls within the vulnerable...

9.1CVSS6.9AI score0.99225EPSS
SaveExploits58
Kitploit
Kitploit
added 2026/08/31 9:26 a.m.4 views

brokeCLAUDIA

🔓 brokeCLAUDIA - CVE-2025-41090 CVE-2025-41090 - Vulnerabilidad de control de acceso roto en microCLAUDIA 📑 Tabla de contenidos ¿Qué es microCLAUDIA? Vulnerabilidad CVE-2025-41090 📂 Divulgación pública CWE Control de acceso roto Remediación Presentación Exploit 📂 Resumen Requisitos Instalación Us...

7.6CVSS5.9AI score0.00317EPSS
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/08/31 7:03 a.m.6 views

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

9.8CVSS5.9AI score0.00323EPSS
SaveExploits2References5
Kitploit
Kitploit
added 2026/08/31 6:16 a.m.4 views

CVE-2025-68434-OSPOS-CSRF

CVE-2025-68434: CSRF Unauthorized Administrator Creation in OpenSourcePOS...

8.8CVSS5.8AI score0.00275EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/08/31 6:02 a.m.4 views

CVE-2026-34926

⚠️ Aviso de Investigación de Seguridad y Responsabilidad Legal 📌 Propósito de este Repositorio Este repositorio se proporciona estrictamente para fines educativos, académicos y de investigación de ciberseguridad autorizada. Está destinado a apoyar la comprensión de: Vulnerabilidades de seguridad y...

6.7CVSS6.8AI score0.12682EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 5:54 a.m.5 views

CVE-2025-66683

CVE-2025-66683 Existe una vulnerabilidad de Cross-Site Request Forgery CSRF en la funcionalidad de actualización de perfil de administrador de CarRentalMS v2.0. El endpoint afectado no implementa protecciones anti-CSRF, lo que permite a un atacante realizar modificaciones no autorizadas del perfi...

5.9AI score
SaveExploits0
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.32 views

Majordomo2 - SMTP/HTTP Directory Traversal

A directory traversal vulnerability in the listfileget function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. dot dot sequences in the help command, as demonstrated using 1 a crafted email and 2 cgi-bin/mjwwwusr in the web interface. id:...

5CVSS7.5AI score0.95388EPSS
SaveExploits12References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.79 views

Agentejo Cockpit < 0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value. id: CVE-2020-35846 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critic...

9.8CVSS7.2AI score0.93292EPSS
SaveExploits11References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.66 views

ElasticSearch <1.6.1 - Local File Inclusion

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...

5CVSS7.4AI score0.94788EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.58 views

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

9.8CVSS7.5AI score0.99826EPSS
SaveExploits21References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.159 views

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

5.3CVSS7AI score0.8764EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.87 views

Splunk <=7.0.1 - Information Disclosure

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. id: CVE-2018-11409 info: name: Splunk =7.0.1 - Information Disclosure author: harshbothra severity: medium...

5.3CVSS6AI score0.98314EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.112 views

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

7.2CVSS7.3AI score0.90461EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.809 views

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

7.5CVSS6.8AI score0.76875EPSS
SaveExploits18References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.173 views

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

9.8CVSS7.3AI score0.97405EPSS
SaveExploits19References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.174 views

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

7.5CVSS7.3AI score0.97369EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.188 views

ZyXel USG - Hardcoded Credentials

A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. id: CVE-2020-29583 info: name: ZyXel USG - Hardcoded Credentials autho...

10CVSS7.4AI score0.90155EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.104 views

ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion

ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile. id: CVE-2016-6601 info: name: ZOHO WebNMS Framework 5.2 SP1 - Local File Inclusion author: 0xAkoko...

7.5CVSS7.2AI score0.97415EPSS
SaveExploits10References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.71 views

Jeecg-Boot v3.5.1 - SQL Injection

SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1. id: CVE-2023-38992 info: name: Jeecg-Boot v3.5.1 - SQL Injection author: ritikchaddha severity: critical description: | SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...

9.8CVSS7.3AI score0.73398EPSS
SaveExploits1References3
Rows per page
Query Builder