CVE-2026-100855

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

EUVD-2026-87820

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100851

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

EUVD-2026-87837

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

EUVD-2026-87685

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

EUVD-2026-87661

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

EUVD-2026-87658

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

EUVD-2026-87734

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

DSXS

Damn Small XSS Scanner Damn Small XSS Scanner DSXS는 100줄 미만의 코드로 작성된 완전한 기능의 크로스 사이트 스크립팅 취약점 스캐너입니다 GET 및 POST 파라미터 지원. 선택적 설정으로 HTTP 프록시와 함께 HTTP 헤더 값 User-Agent, Referer 및 Cookie를 지원합니다. 샘플 실행 root@kitploit: $ python3 dsxs.py -h Damn Small XSS Scanner DSXS 100 LoC Lines of Code v0.3a by:...

extended-xss-search

확장형 XSS 검색 및 찾기 이것은 이미 "xssfinder"로 공개된 초기 아이디어를 기반으로 한 확장 버전입니다. 이 개인 버전은 공격자가 GET뿐만 아니라 POST 요청도 수행할 수 있도록 합니다. 또한 모든 요청을 Burp 또는 다른 터널을 통해 프록시할 수 있습니다. 첫 단계 example.app-settings.conf 파일의 이름을 app-settings.conf 로 변경하고 설정을 조정하세요. 기본적으로 바로 작동해야 하지만, 대상에 따라 청크 크기를 조정하는 것이 좋습니다. 실행 이 도구는 CLI를 통해 인수를...

PyFlooder

PyFlooder 通常のWebサイトを10秒で停止させることができるHTTP Flood Pythonスクリプトです どのように動作しますか？ 設定可能な数のランダムなGETリクエストを生成し、ターゲットに送信します 使用方法 root@kitploit: pyflooder.py...

s3cXSSer

s3cXSSer この拡張機能は、任意のWebサイトでGET/POSTベースのXSS脆弱性を簡単に検出するのに役立ちます。 S3C - XSSER - Chrome拡張機能 ChromeまたはBraveブラウザに追加する方法 1- brave://extensions/ または chrome://extensions/ に移動します 2- デベロッパーモードを有効にして「Load unpacked」をクリックします 3- 拡張機能のフォルダーを探して「OK」をクリックします 注意:...

DSSS

아주 작은 SQLi 스캐너 아주 작은 SQLi 스캐너 DSSS는 100줄 미만의 코드로 작성된 완전한 기능의 SQL 인젝션 취약점 스캐너입니다 GET 및 POST 매개변수 지원. 선택적 설정으로 HTTP 프록시와 함께 HTTP 헤더 값 User-Agent, Referer 및 Cookie를 지원합니다. 실행 예시 root@kitploit: $ python3 dsss.py -h Damn Small SQLi Scanner DSSS 100 LoC Lines of Code v0.3a by: Miroslav Stampar @stampar...

sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

wreckuests

이게 뭐죠? Wreckuests는 HTTP-floodGET/POST를 통해 DDoS 공격을 실행할 수 있는 스크립트입니다. 순수 Python으로 작성되었으며 프록시 서버를 "봇"으로 사용합니다. 물론, 이 스크립트는 만능이 아니며 마우스 클릭 한 번으로 Pentagon/NSA/그 어떤 웹사이트를 마비시킬 수 없습니다. 각 공격은 고유하며, 각 웹사이트마다 취약점을 찾아 익스플로잇해야 합니다. 경고: 이 스크립트는 교육 목적으로만 공개되었습니다! 저자는 사용으로 인해 발생할 수 있는 모든 결과, 손해 또는 손실에 대해 책임을 지...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

LG Supersign EZ CMS - Remote Code Execution

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsrserver/device/getThumbnail. id: CVE-2018-17173 info: name: LG Supersign EZ CMS - Remote Code Execution author: pussycat0x severity: critical description: | LG SuperSign CMS allows remote attackers...

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...