Atlassian Jira Confluence - Cross-Site Scripting

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error messa...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by...

WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting

WordPress Watu Quiz plugin before 3.3.9.1 is susceptible to cross-site scripting. The plugin does not sanitize and escape some parameters, such as email, dn, date, and points, before outputting then back in a page. An attacker can inject arbitrary script in the browser of an unsuspecting user in...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Jeecg-boot 3.5.0 qurestSql - SQL Injection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. id: CVE-2023-1454 info: name: Jeecg-boot 3.5...

WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting

Competition Form WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to visit a...

WPMobile.App <= 11.56 - Open Redirect

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially...

NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

WordPress Symposium <=15.8.1 - Cross-Site Scripting

WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2015-9414 info: name:...

FastChat - Open Redirect

Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs. id: CVE-2024-10908 info: name: FastChat - Open Redirect author: DhiyaneshDK severity: medium description: | Detects an open redirect vulnerability in lm-sys/fastch...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

FUEL CMS 1.4.1 - Remote Code Execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...

zarp

Introduction Zarp est un outil d'attaque réseau centré sur l'exploitation des réseaux locaux. Cela n'inclut pas l'exploitation des systèmes, mais plutôt l'abus des protocoles et des piles réseau pour prendre le contrôle, infiltrer et neutraliser. Les sessions peuvent être gérées pour empoisonner ...

jok3r

.. raw:: html .. image:: ./pictures/logo.png .. raw:: html Jok3r v3 beta .. image:: https://img.shields.io/badge/python-3.6-blue.svg :target: https://www.python.org/downloads/release/python-366/ :alt: Python 3.6 .. image:: https://readthedocs.org/projects/jok3r/badge/?version=latest :target:...

hardentools

Hardentools تم تصميم Hardentools لتعطيل عدد من "الميزات" التي يوفرها Microsoft Windows 10 و 11 وبعض التطبيقات واسعة الاستخدام Microsoft Office و LibreOffice و Adobe PDF Reader، في الوقت الحالي. هذه الميزات، التي تُعتبر عادةً مخصصة لعملاء المؤسسات، غير مفيدة بشكل عام للمستخدمين العاديين بل تشكل...

wpscan

WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...

esp32-wifi-penetration-tool

أداة اختراق Wi-Fi لـ ESP32 يقدم هذا المشروع أداة عالمية لمنصة ESP32 لتنفيذ هجمات Wi-Fi متنوعة. يوفر بعض الوظائف الشائعة المستخدمة في هجمات Wi-Fi ويجعل تنفيذ هجمات جديدة أبسط قليلاً. كما يتضمن هجمات Wi-Fi نفسها مثل التقاط PMKIDs من المصافحات، أو المصافحات نفسها بطرق مختلفة مثل بدء AP مكرر مخادع أو...

PyStegosploit

PyStegosploit — Доставка эксплойтов с помощью стеганографии и полиглотов video1 | video2 | page от Charmve - yidazhang1 at gmaildotcom, @Charmve @therealsaumil @amichael Май 2021 Stegosploit создаёт новый способ кодирования «drive-by» эксплойтов браузера и доставки их через файлы изображений. Эти...

llm-prompt-injection-resources

llm-prompt-injection-resources Une collection organisée de ressources pour apprendre et rechercher les attaques par injection de prompt dans les LLM, les défenses et la sécurité. Faire un don Soutenez la maintenance de ce projet via PayPal ou en scannant le code QR ci-dessous...