crlfi

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install crlfi Run bellow command to check crlfi -h Configurations 2. We integrated with the Telegram API to receive instant notificatio...

CVE-2026-91398

creationtimestamp| type| source ---|---|--- 2026-10-21 12:41:09+00:00| seen| https://infosec.exchange/users/cve/statuses/117478946819086924...

CVE-2026-91397

creationtimestamp| type| source ---|---|--- 2026-10-21 12:40:29+00:00| seen| https://infosec.exchange/users/cve/statuses/117478944161577300...

goca

Goca is a FOCA fork written in Go, which is a tool used mainly to find metadata and hidden information in the documents its scans. These documents may be on web pages, and can be downloaded and analyzed with Goca. It is capable of analyzing a wide variety of documents, with the most common being...

CVE-2026-114402

The Trudesk application (versions through 1.2.11 ) is vulnerable to a path traversal and authorization bypass within the accountsController.uploadImage function. This flaw allows authenticated users to overwrite other users' avatars by manipulating form-supplied _id and username fields. Specifica...

EUVD-2026-107249

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

EUVD-2026-107248

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114401

The Trudesk application (versions through 1.2.11 ) is vulnerable to a regular expression injection flaw in the POST /api/v1/login endpoint. This vulnerability allows unauthenticated attackers to perform username enumeration by submitting specific regex patterns, such as (admin|root) or a.*. By an...

CVE-2026-114402 Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114399 Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

EUVD-2026-107246

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2026-114399

The Trudesk application (versions through 1.2.11 ) is vulnerable to a path traversal vulnerability (CWE-22) within its backup and restore APIs. Specifically, the DELETE /api/v1/backup/:backup endpoint allows administrators to delete arbitrary files by providing encoded traversal sequences. Additi...

CVE-2026-114399 Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing CORS misconfigurations - CVE-2025-34291. CORS Security Scanner A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin...

CVE-2026-91396

creationtimestamp| type| source ---|---|--- 2026-10-21 12:39:51+00:00| seen| https://infosec.exchange/users/cve/statuses/117478941516912565...

CVE-2026-114396

Trudesk through version 1.2.11 is vulnerable to a server-side JavaScript injection via the tickets search API. Authenticated users can inject code into a MongoDB $where clause through the search parameter in a GET request to /api/v1/tickets/search. By closing the regular expression, an attacker c...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114396 Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...