pwndbg

pwndbg pwndbg /paʊnˈdiˌbʌɡ/ is a GDB and LLDB plug-in that makes debugging suck less, with a focus on features needed by low-level software developers, hardware hackers, reverse-engineers and exploit developers. It has a boatload of features, see our Features page and CHEATSHEET feel free to prin...

CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields Denial of Service Exploit This script exploits the CVE-2024-40094 vulnerability in graphql-java by triggering an ExecutableNormalizedFields ENF based denial of service. It builds a crafted GraphQL introspection query with deep nested aliases, designed...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

Django-faille-CVE-2025-57833_test

Testing SQL Injection Vulnerability via Aliases in Django Definition: What is an alias? An alias is a name given to a column or aggregation result in an SQL query. In Django, aliases are used with the annotate or alias methods to name computed fields. Example: root@kitploit: from django.db.models...

CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias

ZenarioCMS Reflected XSS v.9.4.59197 Author: Sergio Description: Cross Site Scripting vulnerability in ZenarioCMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. Attack Vectors: Scripting a vulnerability in the sanitization of th...

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

EternalLiberty

EternalLiberty Description This repository contains all Threat Actor aliases used by different Threat Intelligence companies in their reports. Objectives This allows to find the Threats Actors that you want survey or search in getting the name used by different companies or for attribution of...

EUVD-2026-83510

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

OPENSUSE-SU-2026:21812-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4...

SUSE CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 throu...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

CVE-2026-53509: Server-Side Request Forgery (SSRF)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

Exploit for Improper Privilege Management in Google Chrome

--- 3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit By...

CVE-2026-67316: Improperly Controlled Modification of Object Prototype Attributes

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-62391

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-62391

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...