poisontap

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers Created by @SamyKamkar || https://samy.pl When PoisonTap Raspberry Pi Zero & Node.js is plugged into a locked/password protected computer, it: emulates an Ethernet device over USB or Thunderbolt...

KUMO-Domain-Recon-Tool

Give Kumo a domain and it maps everything reachable about it in one pass: DNS and email security , certificates and subdomains from CT logs, open ports , technology fingerprints , leaked credentials and infostealer infections, cloud buckets , and 358 vulnerability checks against known exposures...

CVE-2026-108804

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the...

CVE-2016-3962-Exploit

CVE-2016-3962, CVE-2016-3989 POC Exploit This is a proof of concept exploit for version V5.30p of the web configuration interface for Meinberg NTP Time Server. This exploit also utilitizes CVE-2016-3989 to escalate to the root user. More details about the vulnerabilities can be found at:...

EUVD-2026-97238

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the...

CVE-2026-108804

The TRENDnet TEW-751DR , TEW-752DRU , and TEW733GR routers (firmware versions 1.03B01/1.03B03 ) are vulnerable to an OS command injection in the Web Management Backend . The flaw exists within the fwrite function of the pigwidgeon.cgi file, where manipulating the service argument allows for remot...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

CVE-2026-34234-Lab

CVE-2026-34234 - CtrlPanel Installer RCE Lab Local Docker lab for demonstrating CVE-2026-34234 in CtrlPanel. This repository compares: vuln: CtrlPanel 1.1.1 pinned by digest patched: CtrlPanel 1.2.0 pinned by digest The lab is local-only and binds services to 127.0.0.1. Summary CVE-2026-34234 is ...

CVE-2025-24016

CVE-2025-24016 How does this detection method work? This Nuclei HTTP template checks a target URL and its /app/login page for the Wazuh web interface, extracts the wazuhVersion value with a regex, and confirms the page is accessible 200 status and actually a Wazuh UI via title and keyword match. ...

API-attack-detection-with-AI

Detection of SQL/XSS Attacks on Web API with Artificial Intelligence / Machine Learning This project aims to detect SQL and XSS injections in API requests/params using machine learning. Project Overview This project aims to detect SQL and XSS injections in API requests and parameters using Machin...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

CVE-2026-108783

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

cve-2021-41773

CVE-2021-41773 – Apache Path Traversal Report Summary Vulnerability found in Apache HTTP Server 2.4.49 that can expose sensitive files on the system through a Path Traversal attack depending on the web server configuration Path Traversal: An attacker can access files outside the web root using...

CVE-2022-3689

CVE-2022-3689 Analysis Report Overview CVE-2022-3689 is an SQL injection vulnerability found in a specific WordPress plugin, which allows an attacker to exploit security vulnerabilities in web applications to insert malicious SQL code into the database. This can lead to serious security issues su...

CVE-2022-21371

CVE-2022-21371 Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor Homepage:...

Electrolink-FM-DAB-TV

Electrolink-FM-DAB-TV For CVE-2025-51040 Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 Description Electrolink FM/DAB/TV Transmitter web management...

CVE-2016-3714

CVE-2016-3714 ImageMagick Code Execution CVE-2016-3714 imagickbuilder.py = Simple Payload Builder to Exploit CVE-2016-3714 imagickbypassshell.php = PHP based web shell leveraging the PHP imagick extension wrapper to bypass disabled functions Few Images of things working: Payload Builder: imagick...