CVE-2024-50379-POC

CVE-2024-50379-POC Dieses Repository enthält ein Python-Skript zur Ausnutzung von CVE-2024-50379 , einer Sicherheitslücke, die es Angreifern ermöglicht, eine JSP-Shell auf einen verwundbaren Server hochzuladen und beliebige Befehle remote auszuführen. Dieser Exploit ist besonders nützlich, wenn d...

PasswordsSniffer

PasswordsSniffer विवरण यह मॉड्यूल असुरक्षित प्रोटोकॉल के उपयोगकर्ता नाम और पासवर्ड को स्निफ करता है। आवश्यकताएँ इस पैकेज के लिए आवश्यक है: python3 python3 मानक पुस्तकालय Scapy स्थापना root@kitploit: pip install PasswordsSniffer उपयोग कमांड लाइन root@kitploit: PasswordsSniffer python3 -m...

Prommetrix

Info: Prommetrix ist ein freies Software-Tool, um relevante Informationen von den Instanzen des 'Node Exporter' zu erhalten, die von 'Prometheus' ausgeführt werden. Prometheus ist eine Open-Source-Lösung für metrikenbasiertes Ereignis-Monitoring und Alerting für Cloud-Anwendungen. Es wird von fas...

CVE-2026-14960-CVE-2026-14961

Vulnerabilidades de Escalonamento de Privilégios no Driver TdeIo64 da Pegatron tdeio64.sys | ---|--- IDs de CVE| CVE-2026-14960, CVE-2026-14961 Fornecedor| Pegatron Corporation Produto| Driver TdeIo tdeio64.sys Interface de Dispositivo| \.\TdeIo Tipos de Vulnerabilidade| Controlo de Acesso...

cve-2019-14220

Zusammenfassung Eine ungeschützte Methode in einem bstutils-Dienst in BlueStacks 4.120 und darunter auf dem Mac und 4.110 und darunter auf Windows ermöglicht es einem lokalen Angreifer, den Inhalt beliebiger Dateien mit Systemberechtigungen zu lesen. Beschreibung BlueStacks ist ein...

CVE-2024-10673

🔥 Panoramica Questo script sfrutta CVE-2024-10673 , una vulnerabilità critica presente nel Top Store WordPress Theme = 1.5.4. La falla consente a utenti autenticati con accesso a livello di abbonato o superiore di installare e attivare plugin arbitrari tramite richieste AJAX non protette. ⚠️...

CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

EUVD-2026-56031

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before...

CVE-2026-72561

CVE-2026-72561 describes a broken access control in Peppermint Lab Peppermint. Through commit ba6e217, any authenticated non-administrative user can reconfigure the platform’s global OIDC/SSO settings via an unprotected configuration endpoint that performs no administrative role check before appl...

CVE-2026-72561 Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before...

ROS-20260810-73-0007

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

ROS-20260810-73-0005

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

ROS-20260810-73-0004

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-67621

Flowise 3.1.4 has a missing authorization flaw on document store mutation endpoints (upsert and refresh). This allows authenticated workspace members with only view-level permissions to perform unauthorized document ingestion, refresh the vector database contents, consume embedding API credits, a...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

SUSE CVE-2026-52800

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...

CVE-2026-60113

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...