Zimbra Collaboration Suite < 8.8.15 - Improper Encoding

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 update 1, as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing...

Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

avoidz

Avoidz v 1.3 Autor: Mascerano Bachir dev-labs Aviso legal: El autor no se hace responsable del mal uso de esta herramienta, recuerde que esto es solo con fines educativos. Descripción: Esta herramienta genera powershell codificado con payloads de metasploit, convierte plantillas de C, C, py, go a...

CVE-2020-13933

CVE-2020-13933 Lab Shiro 1.6.0 Authentication Bypass Vulnerability PoC http://127.0.0.1:8080/res/%3bpoc Lab Environment Code Description ShiroConfig.java: Permission configuration: when requesting /res/ resources, it returns a 302 redirect to the login page for authentication. NameController.java...

decoder-plus-plus

Decoder++ Decoder++ es una aplicación extensible diseñada para pentesters, desarrolladores de software y cualquier persona que necesite decodificar y codificar datos sin esfuerzo en diversos formatos. Incluye una amplia gama de scripts y códecs preinstalados, decodificación inteligente e...

DrupalCVE-2018-7602

Drupal Remote Code Execution Vulnerability CVE-2018-7602 Affected software: drupal Method: Encode the in the URL twice to bypass the sanitize function filtering Effect: Arbitrary command execution Vulnerability Environment Execute the following command to start the drupal 7.57 environment:...

CLEANSTART-2026-LB53139 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding

Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...

CLEANSTART-2026-AF46685 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device. The vulnerability primarily stems from...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling For educational purposes only Setup $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirm /admin is denied. $ curl...

PT-2026-107785

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

cve-2023-5217-poc

CVE-2023-5217: libvpx VP8 Encoding Heap Overflow PoC CVE-2023-5217 is an in-the-wild exploited libvpx vulnerability that was found by Clément Lecigne of Google's Threat Analysis Group to be targeting Chrome. This repo shows how to trigger CVE-2023-5217 in the browser using the WebCodecs and...

pydictor

pydictor README.md中文版 pydictor —— A powerful and useful hacker dictionary builder for a brute-force attack | | | | ' | | | |/ | |/ | / | '| | | | || | | | | | || | | | ./ , |,|||\/|| || |/ Email: [email protected] Preface： Q: Why I need to use pydictor ? A: 1.it always can help you You...

cve-2022-21907-http.sys

cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - Double Free in http.sys driver. Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to process...

recollapse

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post. The goal of this tool ...

ZipExec

ZipExec ZipExec es una herramienta de Proof-of-Concept POC para envolver herramientas basadas en binarios en un archivo zip protegido por contraseña. Este archivo zip luego se codifica en base64 a una cadena que se reconstruye en disco. Esta cadena codificada se carga en un archivo JScript que, a...

batchfuscate

batchfuscate Un script simple y eficiente para hacer que tu payload batch sea indetectable. Requisitos: 1. python3 debe estar instalado en Windows y Linux 2. pip install termcolor pip install pystyle pip install tqdm pip install colorama pip install requests Instalación:- 1. Clona el repositorio ...