CVE-2020-35590

Informazioni sull'Exploit Titolo Exploit: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Data: 2020-06-09 Autore Exploit: N4nj0 Link Software: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Versione: 2.13.0 Testato su: WordPress 5.4.1,...

Windows-7-EternalBlue-Exploitation

SMB EternalBlue Exploitation — Windows 7 Lab Target Discla...

CVE-2021-43798

CVE-2021-43798: Vulnerabilità di lettura arbitraria di file in Grafana Aggiunto template nuclei per il riconoscimento di tutte le versioni Windows+Linux Elenco di 52 plugin: root@kitploit: live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canv...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shopping-system online-shopping-system è vulnerabile ad attacchi SQL Injection non autenticati di tipo error/boolean-based blind ed error-based. Il parametro proId della pagina /action.php non sanitizza l'input dell'utente; un attaccante può...

CVE-2025-57833

CVE-2025-57833: Django SQL-Injection-Schwachstelle Dieses Repository demonstriert und erklärt CVE-2025-57833, eine kritische SQL-Injection-Schwachstelle in Djangos ORM, die die Versionen 4.2 vor 4.2.24, 5.1 vor 5.1.12 und 5.2 vor 5.2.6 betrifft. 🚨 Übersicht über die Schwachstelle CVSS-Wert : 9.8...

hakrawler

Hakrawler Veloce web crawler in golang per raccogliere URL e posizioni di file JavaScript. Si tratta fondamentalmente di una semplice implementazione della fantastica libreria Gocolly. Esempi di utilizzo URL singolo: root@kitploit: echo https://google.com | hakrawler URL multipli: root@kitploit:...

CVE-2026-13768

CVE-2026-13768: Credenziale privilegiata dell'IoT Hub — Enumerazione della flotta, RCE sul dispositivo e pivot nella rete domestica Advisory Campo| Valore ---|--- CVE| CVE-2026-13768 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 10.0 Critico Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:...

CVE-2022-27414

CVE-2022-27414 - Iniezione SQL College Website CMS v1.0 - CVE-2022-27414 - Iniezione SQL URL CVE root@kitploit: https://vulners.com/cve/CVE-2022-27414 PoC di seguito Codice vulnerabile inizia dalla riga 9 in "cwms\departments\index.php" root@kitploit: query"SELECT FROM departmentlist where...

CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

metabase-sql-poc

CVE-2026-72898 — Metabase Unauthenticated SQL Injection PoC...

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

LPE---CVE-2020-0796

Utilizzo: Assicurati che Python sia installato, poi esegui poc.py. Windows Kernel Write-What-Where CVE-2020-0796 Exploit Destinato solo a scopi educativi e di test in ambienti aziendali. MasterSpl0it non si assume alcuna responsabilità per il codice, usalo a tuo rischio. POC riscritto per...

lighty-sqlinj-demo

title: Ep4 - Vulnerabilità relativa alle reti members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Vulnerabilità correlata: root@kitploit: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Conferma:...

CVE-2022-40032_Simple-Task-Managing-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

CVE-2022-40032: Simple Task Managing System - 'login' e 'password' Injeção SQL Não Autenticado Título do Exploit: Simple Task Managing System - 'login' e 'password' Injeção SQL Não Autenticado Data: 2022-01-09 Autor do Exploit: Hamdi Sevben Vendor Homepage:...

SecretFinder

Über SecretFinder SecretFinder ist ein Python-Skript, das auf LinkFinder basiert. Es wurde entwickelt, um sensible Daten wie apikeys, accesstoken, authorizations, jwt, usw. in JavaScript-Dateien zu entdecken. Dies geschieht durch die Verwendung von jsbeautifier für Python in Kombination mit einem...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atenbank-A ngriffs-W erkzeug ist ein Open-Source-Penetrationstest-Tool, das die Sicherheit von Microsoft SQL-Datenbanken remote testet. Anwendungsbeispiele von MSDAT: Sie haben eine Microsoft-Datenbank,...

CVE-2025-65881

CVE-2025-65881 Il progetto Zoo Management System v1.00 è vulnerabile a Cross-site scripting XSS su /zms/classes/Login.php?f=login a causa di: 1. Content-type non valido delle risposte JSON su /zms/classes/Login.php?f=login 2. Input utente non sanificato nelle risposte Consentendo a attaccanti non...