CVE-2025-55182-bypass

CVE-2025-55182 Header Bypass Next-Action header bypass for CVE-2025-55182. Achieves React RSC RCE without distinctive headers, bypassing WAF rules. Key Finding The Next-Action header is NOT required for exploitation. Attack Vector| Next-Action Header| WAF Detection ---|---|--- Original CVE|...

dnxfirewall

NOTICE: The license has changed from the CMD version GPLv3. The 'FULL' version current branch is licensed under AGPLv3. Overview DNXFIREWALL™ is an optimized/high performance collection of applications and services to convert a standard linux system into a zone based next generation firewall. The...

Gixy-Next

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

CVE-2024-21762

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-21762...

CVE-2023-49438

CVE-2023-49438 Proof of Concept Description An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectloc...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

Fireaway

FireAway-Next Generation Firewall Bypass Tool v0.2 Fireaway is a tool for auditing, bypassing, and exfiltrating data against layer 7/AppID inspection rules on next generation firewalls, as well as other deep packet inspection defense mechanisms, such as data loss prevention DLP and application...

CVE-2026-94485

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

CVE-2026-94485

The Next.js framework (versions 16.0.0 through 16.3.8 ) contains a vulnerability in the next dev development server. The server exposes a Model Context Protocol (MCP) endpoint that lacks reliable restrictions on cross-site requests . If a developer visits a malicious website while the development...

EUVD-2026-91673

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

EvilWinRM-NG

EvilWinRM-NG Getting started To make it easy for you to get started with GitLab, here's a list of recommended next steps. Already a pro? Just edit this README.md and make it your own. Want to make it easy? Use the template at the bottom! Add your files Create or upload files Add files using the...

meterssh

Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...

wappalyzer-next

Wappalyzer Next このプロジェクトは、Wappalyzerブラウザ拡張機能とそのフィンガープリントを使用して技術を検出するコマンドラインツールおよびPythonライブラリです。公式オープンソースプロジェクトの終了後に登場した他のプロジェクトは、古いフィンガープリントを使用しており、動的Webアプリでの精度が不足しています。このプロジェクトは、Playwrightを介してChromiumで拡張機能を実行することで、これらの制限を回避します。 インストール ユーザー向け 開発者向け FAQ インストール...

AxxonSoft Axxon Next - Local File Inclusion

AxxonSoft Axxon Next suffers from a local file inclusion vulnerability. id: CVE-2018-7467 info: name: AxxonSoft Axxon Next - Local File Inclusion author: 0xAkoko severity: high description: AxxonSoft Axxon Next suffers from a local file inclusion vulnerability. impact: | An attacker can read...

Quiz and Survey Master <= 8.1.4 - SQL Injection

ExpressTech Quiz And Survey Master versions up to 8.1.4 contains an SQL injection caused by improper neutralization of special elements used in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires user interaction. id: CVE-2023-28787 info: name: Quiz and Survey Master =...

SickChill - Open Redirect

SickChill's login endpoint's 'next' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page. id: CVE-2024-53995 info: name: SickChill - Open Redirect...