CVE-2026-93647 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93647

The Zimbra Collaboration Suite Classic Web Client is vulnerable to a stored Cross-Site Scripting (XSS) flaw. An unauthenticated calendar sender can inject active markup into the RFC From address of a COUNTER message . When a user selects this message within Zimbra Classic, the XSS is triggered, p...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642

The Zimbra Collaboration Suite Modern Web Client is vulnerable to Stored Cross-Site Scripting (XSS) due to a flaw where an unauthenticated sender can forge a share notification. When a signed-in Zimbra Modern recipient clicks the Accept Share button, the XSS is triggered. This allows an attacker ...

CVE-2026-93641

The Zimbra Collaboration Suite Classic Web Client is vulnerable to Stored Cross-Site Scripting (XSS) . An unauthenticated sender can forge a share notification that, when clicked by a signed-in recipient, executes malicious scripts. This allows an attacker to access mailbox data and act as the vi...

CVE-2026-93641 Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

CVE-2024-0311

CVE-2024-0311 ? Esta es una PoC de lo que creo que es CVE-2024-0311, SB10418. Un usuario interno malintencionado puede eludir la política existente de Skyhigh Client Proxy sin un código de liberación válido. Muchos detalles. Muy exploit. ¯\ツ /¯ La PoC inyecta en un proceso SCPBypass.exe ejecutado...

fofa_viewer

release下载 · 反馈Bug · 提交需求 中文 | EN 简介 Fofa Viewer 是一个用 JavaFX 编写的用户友好的 FOFA 客户端，属于 WgpSec 社区，主要由 f1ashine 维护。 利用强大的互联网搜索引擎FoFa，将众多常用的API封装到简洁的UI中，让网络安全专业人士更容易在目标网站上寻找漏洞。 凭借其开箱即用的功能，Fofa Viewer 简化了搜索过程，帮助渗透测试人员快速获取所需信息。 使用说明 本工具基于 FoFa 的 API 进行封装，使用时需要高级会员或者普通会员的 API key，使用注册用户的 API key 会提示账户需要充值F币。...

AdaptixC2

AdaptixC2 v1.2 FEB, 28: ¿Qué ha cambiado en la versión v1.2? Adaptix es un marco extensible de post-explotación y emulación adversarial diseñado para pruebas de penetración autorizadas. El servidor Adaptix está escrito en Golang para permitir flexibilidad al operador. El cliente GUI está escrito ...

cve-2026-43687

CVE-2026-43687 — Notas de ingeniería inversa y reproducción Ingeniería inversa independiente de la condición de carrera de la caché de acceso del cliente NFS de macOS CVE-2026-43687, además de un PoC funcional que desencadena la carrera y la captura en vivo con dtrace. El fallo es una lectura no...

Citrix_Secure_Access_LPE_0DAY

Citric Secure Access Local privilege escalation I have discovered a local privilege escalation vulnerability in the Citrix Secure Access Windows Client. This vulnerability allows a privileged administrator to inject a malicious payload to gain NT Authority privileges. The affected versions of...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2019-17638-Jetty

JETTY El proyecto Jetty es un servidor HTTP 100% Java, un cliente HTTP y un contenedor de servlets de la fundación Eclipse. http://www.eclipse.org/jetty/ Jetty es de código abierto y tiene doble licencia: Apache 2.0 y Eclipse Public License 1.0. Puedes elegir cualquiera de las dos licencias al...

disclosures

Divulgaciones Este es un repositorio que documenta problemas de seguridad que he encontrado. El cliente de Citrix para Linux filtra credenciales a syslog El cliente de Citrix para Linux crea archivos ICA temporales de forma insegura CVE-2023-24486...

vulnrepo

VULNRΞPO - 漏洞报告生成器与仓库 一款面向安全专业人员的客户端、隐私优先的漏洞报告管理器。所有数据均经加密并存储在本地浏览器中——默认情况下，不会向任何服务器发送任何数据。 在线应用： https://vulnrepo.com/ | 开发分支： https://dev.vulnrepo.com/ 视频演示/教程： 目录 功能特性 安全模型 支持的导入来源 报告导出格式 方法论工具 AI / LLM 集成 快速开始 前提条件 开发服务器 生产构建 Docker 项目结构 API 集成 浏览器支持 贡献指南 许可协议 功能特性 客户端加密 — 报告在浏览器中加密后存储；无需后端...

metashield-clean-up-sdk-python

============================== Metashield-clean-up-sdk-python Instalación Instale el paquete metashieldcleanup usando pip:: root@kitploit: pip install metashieldcleanup Uso Ejemplo para limpiar un archivo. .. code-block:: python root@kitploit: import time import base64 from metashieldcleanup.api...

plution

plution 使用无头Chrome扫描原型污染 这是什么 Plution 是一种便捷的方式，可大规模扫描通过URL负载易受客户端原型污染攻击的页面。在默认配置中，它将使用一个硬编码的负载，能够检测到此处记载的11种情况：https://github.com/BlackFan/client-side-prototype-pollution/tree/master/pp 这不是什么 这不是一个一站式解决方案。原型污染是一个复杂的难题。这个工具并没有做任何你手动无法完成的事情。它不是一个经过打磨、无错误的超级工具。它可以工作，但编码不佳，最多只能算作alpha版本。 工作原理 Plution...

plution

plution Prototype pollution scanner using headless chrome What this is Plution is a convenient way to scan at scale for pages that are vulnerable to client side prototype pollution via a URL payload. In the default configuration, it will use a hardcoded payload that can detect 11 of the cases...

pphack

pphack 高级客户端侧原型污染扫描器 由 edoardottt 用 💙 编写 在 Twitter 上分享！ 安装 • 快速开始 • 示例 • 更新日志 • 贡献 • 许可证 安装 📡 使用 Go root@kitploit: go install github.com/edoardottt/pphack/cmd/pphack@latest pphack 依赖于 chromedp，因此你需要 Chrome 或基于 Chromium 的浏览器。 快速开始 🎉 root@kitploit: Usage: pphack flags Flags: INPUT: -u, -url string...