burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i, --issue-type-id String...

CVE-2026-94274

The YayReviews WordPress plugin (versions 1.0.4 through 1.4.0 ) contains a vulnerability where an API route lacks proper access restrictions. This oversight allows unauthenticated attackers to retrieve individual customer review records, including those still pending moderation. Consequently, att...

CVE-2026-90953

The Image Optimizer WordPress plugin, developed by Elementor , is vulnerable in versions prior to 1.7.7 . The root cause is a failure to enforce intended capability checks on several read REST routes , which allows any authenticated user to access attachment metadata and site-wide statistics . Th...

EUVD-2026-89617

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...

EUVD-2026-89629

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-86789

The Connections Business Directory WordPress plugin, through version 10.4.67 , contains a vulnerability where visibility and moderation-status restrictions are not applied on specific REST API read endpoints . This flaw allows unauthenticated attackers to retrieve directory entries marked as priv...

EUVD-2026-89634

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-83560

The New User Approve WordPress plugin, in versions before 3.2.10 , contains an authentication bypass vulnerability. When an integration is left unconfigured , the plugin fails to properly verify authentication on specific integration REST API routes . This allows unauthenticated attackers to retr...

hoverfly

API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

theHarvester

About theHarvester is a simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence OSINT gathering to help determine a domain's external threat landscape. The tool gathers names, emails,...

trape

trape stable v2.0 People tracker on the Internet: Learn to track the world, to avoid being traced. Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how larg...

Tiredful-API

What is Tiredful API? Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security...

archerysec

Support. Your generous donations will keep us motivated. Paypal: Archery Overview of the tool Note Requirements OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners Installation Windows Installation Note on installation for developers and contributors Note on manual and automated installatio...

Cve-api

Parse & filter the latest CVEs from https://cve.mitre.org Docs Usage http://localhost:4000/cve?target=KEYWORD The year parameter is optional. http://localhost:4000/cve?target=KEYWORD&year=YEAR Examples http://localhost:4000/cve?target=ruby%20on%20rails...

CVE-2026-84842

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Plantilla de Nuclei: CVE-2022-1598.yaml VÍDEO POC: https://www.youtube.com/watch?v=MbhiQKWvivQ Referencias: https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities. Aspect| Information ---|--- Tool name| IaC Scan Runner Docker image| xscanner/runner PyPI package| iac-scan-runner Documentation| docs Contact us| [email protected] Table of Contents Description Runnin...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP 产品的 iControl REST API 功能中存在一个远程代码执行漏洞。未经身份验证的远程攻击者可以利用此漏洞绕过身份验证，并以 root 权限执行任意命令。 用法 python3 f5bigipscanner.py...

CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...