interactsh-web

Interactsh Web Client Interactsh 用の Next.js ベースの Web インターフェース はじめに 前提条件 Node.js 20+（React 19 に必要） npm、yarn、pnpm インストール 1. リポジトリをクローンします: git clone https://github.com/projectdiscovery/interactsh-web.git cd interactsh-web 2. 依存関係をインストールします: npm install or yarn install 3. 開発サーバーを起動します: npm run dev o...

CVE-2022-27925

CVE-2022-27925 Zimbra RCE 2022 このリポジトリは hgrab-framework の一部です dork title: "Zimbra Web Client Sign In" 影響を受ける製品 Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 およびそれ以前 Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 およびそれ以前 インストール サーバーにアプリをインストールします user@domain: git clone...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 테스트 환경 및 Nuclei 템플릿 이 저장소는 CVE-2021-21980vSphere Web Client 경로 순회을 탐지하는 높은 신뢰도의 Nuclei 템플릿과 안전한 로컬 테스트를 위해 취약한 동작을 재현하는 작은 모의 환경을 포함합니다. 파일: cve-2021-21980.yaml: 여러 인코딩 변형과 매처가 포함된 Nuclei 템플릿 app.py: /eam/vib 경로 순회 취약점을 시뮬레이션하는 작은 Flask 앱 Dockerfile: 자체 서명 TLS...

Cisco ASA Inconsistent Interpretation of HTTP Requests (CVE-2022-20713)

A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is du...

Cisco ASA Cross-site Scripting (CVE-2024-20341)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

Cisco ASA Basic XSS (CVE-2024-20382)

A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a browser that is accessing an affected...

CVE-2025-30349

Horde IMP の脆弱性 – HTML エンコーディングによる難読化 – XSS ペイロード Horde 5.2.23; IMP 6.2.27 脆弱性の詳細は Details.md ファイルで説明されています。 PoC は、脆弱性を悪用するペイロードを含むメールを作成し、受信者に送信します。この種のメールは、Horde Web クライアントで表示する必要があります（デスクトップクライアントなどの他のクライアントでは表示できません）。...

vcenter-cve-2021-21980-lab

CVE-2021-21980 취약한 테스트 환경 개요 VMware vSphere Web Client의 경로 탐색 취약점을 시뮬레이션하는 실제적인 테스트 환경입니다. ⚠️ 경고: 취약한 테스트 환경입니다. 인터넷에 노출하지 마세요! 빠른 시작 빌드 및 실행 podman build -t vcenter-lab . podman run -d -p 443:443 --name vcenter-lab vcenter-lab 수동 테스트 curl -k...

CVE-2026-104286-POC

FortiMail CVE-2026-104286 パストラバーサルエクスプロイト 概要 FortiMail における CVE-2026-104286 の高度な未認証リモート任意ファイル書き込みエクスプロイト。細工された HTTP/HTTPS リクエストが Web クライアントのパスサニタイズをバイパスし、基盤 OS 上での任意ファイル作成を可能にします。レッドチーム評価、永続化インプラント、および FortiMail デプロイメントへの標的型侵害に使用されます。 影響を受けるバージョン FortiMail 8.0.x 8.0.2、7.6.x 7.6.6、7.4.x 7.4.8、7.2....

CVE-2025-47812

CVE-2025-47812 이 탐지 방법은 어떻게 작동하나요? 이 Nuclei 템플릿은 웹 클라이언트의 HTML 응답에 노출된 7.4.4보다 오래된 버전을 식별하여 CVE-2025-47812에 취약한 Wing FTP Server 인스턴스를 탐지합니다. 이 스크립트를 어떻게 실행하나요? 1. 여기에서 Nuclei를 다운로드하세요. 2. 템플릿을 로컬 시스템에 복사하세요. 3. 다음 명령을 실행하세요: nuclei -u https://yourHost.com -t template.yaml 참고 자료...

Exploit for CVE-2026-104286

FortiMail CVE-2026-104286 Path Traversal Exploit Overview...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647

The Zimbra Collaboration Suite Classic Web Client is vulnerable to a stored Cross-Site Scripting (XSS) flaw. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message . When a user selects this message within Zimbra Classic, the XSS is triggered, p...

CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642

The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...

CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...