CVE-2026-104441

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

EUVD-2026-91469

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

malware-ioc

Lucid The Lucid Phishing-as-a-Service PhAAS platform, developed by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services. Utilizing advanced technologies like RCS and iMessage, the group employs automated tools and evasi...

smbtakeover

smbtakeover A technique to unbind and rebind 445/tcp on Windows without loading a driver, loading a module into LSASS, or rebooting the target machine. Implemented to ease the burden of SMB-based NTLM relays while operating over C2. Technical analysis of the technique is dicussed in more detail...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

portSpider

██████╗ ██████╗ ██████╗ ████████╗███████╗██████╗ ██╗██████╗ ███████╗██████╗ ██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝██╔══██╗██║██╔══██╗██╔════╝██╔══██╗ ██████╔╝██║ ██║██████╔╝ ██║ ███████╗██████╔╝██║██║ ██║█████╗ ██████╔╝ ██╔═══╝ ██║ ██║██╔══██╗ ██║ ╚════██║██╔═══╝ ██║██║ ██║██╔══╝ ██╔══██╗ ██║...

security_monkey

NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020. For AWS users, please make use of AWS Config. For GCP users, please make use of Cloud Asset Inventory. Security Monkey Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

envizon

envizon - by evait security EOL https://github.com/evait-security/envizon/issues/130 We evait security moved to https://gitlab.com/invuls/pentest-projects/pcf for internal project documentation. network visualization & pentest reporting Version 5.0 This tool is designed, developed and supported b...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

ioccheck

ioccheck A tool for simplifying the process of researching file hashes, IP addresses, and other indicators of compromise IOCs. Features Look up hashes across multiple threat intelligence services, from a single command or a few lines of Python. Currenty supports the following services: VirusTotal...

Drupal-cve-2019-6340

Research CVE 2019-6340 The site as Drupal 8 core RESTful API Services module gets enabled and allows the user to send GET, PATCH or POST Request to the server. GET request is enough to trigger the code execution vulnerability even though PATCH method is disabled The site has any other web service...

CVE-2026-82040: Server-Side Request Forgery (SSRF)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-85215: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09...

CVE-2026-104470: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

PT-2026-104251

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

PT-2026-104435

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

The vulnerability lies in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea. This vulnerability allows a attacker to compromise the integrity and accessibility of the protected information.

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

The vulnerability in the `services/lfs/server.go` and `routers/private/serv.go` files of the Git repository management system Gitea allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...