Lucene search
+L

660 matches found

Kitploit
Kitploit
added 2026/09/15 7:42 a.m.12 views

CVE-2021-29447

CVE-2021-29447 POC to exploit WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. More about this CVE here Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress website with Media Library vulnerable to XXE Injection. root@kitploit: python lfi.py -u manager -p...

7.1CVSS6.9AI score0.85719EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/15 6:30 a.m.8 views

CVE-2025-66516-POC

⚠️ 使用前请阅读免责声明 ⚠️ 仅限教育/授权测试 | 许可证 | 安全政策 关于此POC 本仓库包含针对 CVE-2025-66516 的概念验证(POC)利用代码,该漏洞是 Apache Tika 3.2.2 之前版本中的一个 XML 外部实体(XXE)注入漏洞 。漏洞影响 tika-parser-pdf-module 组件中的 XFA(XML 表单架构)解析器 ,允许攻击者通过精心构造的 PDF 文档读取本地文件并窃取敏感数据。 什么是 CVE-2025-66516? CVE-2025-66516 是 Apache Tika PDF 解析功能中的一个 严重安全漏洞 。在处理包含嵌入式...

9.8CVSS7.8AI score0.87688EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.29 views

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

9.8CVSS7.6AI score0.37713EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.86 views

TablePress < 2.4.3 - XXE Injection

The PHPSpreadsheet library used by the plugin is affected by an XXE as the security scanner that prevents XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files...

7.5CVSS5.8AI score0.02799EPSS
SaveExploits1References4
Kitploit
Kitploit
added 2026/09/15 5:29 a.m.10 views

SAMLRaider

SAML Raider - Extensión de Burp para SAML2 Descripción SAML Raider es una extensión de Burp Suite para probar infraestructuras SAML. Contiene dos funcionalidades principales: manipular mensajes SAML y gestionar certificados X.509. Este software fue creado originalmente por Roland Bischofberger y...

5.9AI score
SaveExploits0References8
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/15 3:08 a.m.11 views

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with jaxws-2.2, xmlWS-3.0, xmlWS-4.0, wsSecurity-1.1 or wsAtomicTransaction-1.2 enabled. Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL throu...

7.5CVSS0.00409EPSS
SaveExploits0Affected Software1
Kitploit
Kitploit
added 2026/09/15 12:41 a.m.9 views

CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

9.8CVSS7.8AI score0.87688EPSS
SaveExploits6References1
EUVD
EUVD
added 2026/09/15 12:31 a.m.6 views

EUVD-2026-78155

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or...

6.8CVSS0.00223EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/15 12:00 a.m.6 views

CVE-2018-12463

CVE-2018-12463 Vulnerabilidad de entidad externa XML XXE en /ssc/fm-ws/services en Fortify Software Security Center SSC 17.10, 17.20 y 18.10 permite a usuarios remotos no autenticados leer archivos arbitrarios o realizar ataques de falsificación de solicitudes del lado del servidor SSRF mediante ...

9.8CVSS7.5AI score0.13849EPSS
SaveExploits4
CVE
CVE
added 2026/09/14 9:16 p.m.10 views

CVE-2026-12756

IBM Business Automation Workflow (containers and traditional) is vulnerable to an XML External Entity (XXE) injection when processing XML data. A remote attacker with low privileges could exploit this to expose sensitive information or consume memory resources . The vulnerability is rated CVSS 7....

7.1CVSS0.00496EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/14 9:16 p.m.21 views

CVE-2026-12756 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

7.1CVSS0.00496EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/14 9:08 p.m.6 views

EUVD-2026-78153

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote...

7.1CVSS0.00385EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/14 8:54 p.m.7 views

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052, vulnerabilidad de fuga de información en el analizador de archivos DMG de ClamAV Uso Para crear un archivo DMG malicioso root@kitploit: git clone https://github.com/nokn0wthing/CVE-2023-20052.git cd CVE-2023-20052 sudo docker build -t cve-2023-20052 . sudo docker ru...

5.3CVSS7.5AI score0.07003EPSS
SaveExploits5
NVD
NVD
added 2026/09/14 8:16 p.m.8 views

CVE-2026-16432

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

7.7CVSS0.00343EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 7:48 p.m.14 views

CVE-2026-16432

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to XML External Entity (XXE) injection in the PxXMLInput operator (CWE-611). A remote authenticated attacker can exploit this flaw to obtain sensitive information, with the scope of impact extending beyond the vulnerable component (CVSS 3....

7.7CVSS0.00343EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/14 7:48 p.m.26 views

CVE-2026-16432 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

7.7CVSS0.00343EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/14 7:48 p.m.6 views

EUVD-2026-77794

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

7.7CVSS0.00343EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/14 1:47 p.m.5 views

Security Bulletin: IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection (CVE-2026-13265)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer component of the IBM MQ REST API Vulnerability Details CVEID:CVE-2026-13265 DESCRIPTION: IBM MQ could allow an authenticated attacker with MFT publish authority to obtain sensitive information or...

6.8CVSS0.00223EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/14 1:35 p.m.8 views

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13275)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer agent Vulnerability Details CVEID:CVE-2026-13275 DESCRIPTION: IBM MQ Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to...

7.1CVSS0.00251EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/14 11:31 a.m.6 views

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13285)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer template parser Vulnerability Details CVEID:CVE-2026-13285 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit...

7.1CVSS0.00385EPSS
SaveExploits0Affected Software1
Rows per page
Query Builder