0xWhoami35

4 exploits Active since Feb 2023
CVE-2023-23752 NOMISEC MEDIUM WORKING POC
Joomla! 4.0.0-4.2.7 - Unauthenticated Improper Access Control in Webservice Endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
2 stars
CVSS 5.3
CVE-2025-2294 NOMISEC CRITICAL WORKING POC
Kubio AI Page Builder <2.5.1 - Local File Inclusion
The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS 9.8
CVE-2024-4879 NOMISEC CRITICAL WORKING POC
ServiceNow Vancouver and Washington DC - Unauthenticated Remote Code Execution
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS 9.8
CVE-2023-33747 NOMISEC HIGH STUB
CloudPanel 2.0.0-2.2.2 - Path Traversal
CloudPanel v2.2.2 allows attackers to execute a path traversal.
CVSS 7.8