rewerse-engineering

rewerse engineering Неофициальный клиент API REWE на Go и Python. Он реализует публично доступные неаутентифицированные конечные точки, которые приложение REWE использует для запроса текущих скидок Angebote, товаров, магазинов и отзывов. Поддерживаемая версия APK: 5.16.2 по состоянию на 06.08.26...

cve-2022-36804

CVE-2022-36804: Pre-Auth RCE в Atlassian Bitbucket Server Критическая уязвимость внедрения команд была обнаружена в нескольких конечных точках API сервера Atlassian Bitbucket и Data Center. Эта уязвимость затрагивает все версии Bitbucket Server и Data Center, выпущенные до версий 7.6.17, 7.17.10,...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner — это мощный и удобный инструмент, предназначенный для выявления потенциальных уязвимостей на сайтах WordPress путем проверки их API-конечных точек. Сканер предназначен для помощи владельцам сайтов, разработчикам и специалистам по безопасност...

API-s-for-OSINT

APIs For OSINT root@kitploit: Это коллекция API, которые будут полезны для автоматизации различных задач в OSINT. Инструкция для полных новичков: OSINT automation: using сustom functions for working with API requests in Google Sheets Спасибо, что следите за мной! https://cybdetective.com Содержан...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

py3webfuzz

Py3webFuzz ';-- Библиотека модулей для веб-фаззинга на Python Совместимо с Python3 Автор Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Участники проекта Nathan Hamiel @nathanhamiel ОПИСАНИЕ Основанный на pywebfuzz, Py3webfuzz — это модуль Python3 для помощи в выявлении...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — CyberPanel AI Scanner 인증되지 않은 읽기/쓰기 API 접근 2.4.4 이전 버전의 CyberPanel에 영향을 미치는 CVE-2026-41473용 Nuclei 탐지 템플릿입니다. 취약점 CyberPanel의 AI Scanner 기능은 인증 없이 두 개의 API 엔드포인트를 노출합니다:...

Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804 Atlassian Bitbucket Server 및 Data Center의 여러 API 엔드포인트에서 심각한 명령 주입 취약점이 발견되었습니다. 이 취약점은 , , , , , , 버전 이전에 릴리스된 모든 Bitbucket Server 및 Data Center 버전에 영향을 미칩니다. CVE-2022-36804 실습 환경 Docker 빌드 root@kitploit: docker build -t bitbucket . Docker 실행...

CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints. Attackers who obtain an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without the second factor. The vulnerabi...

CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

CVE-2026-35616

CVE-2026-35616 — FortiClient EMS 사전 인증 우회 FortiClient Endpoint Management Server 인증 우회CVE-2026-35616에 대한 개념 증명PoC 이 스크립트는 FortiClient EMS의 인증 우회 취약점을 악용하여 보호된 API 엔드포인트에 대한 인증되지 않은 접근을 허용합니다. 영향을 받는 버전 FortiClient EMS 7.4.5, 7.4.6 패치된 버전 FortiClient EMS 7.4.7 요구 사항 root@kitploit: pip install...

PT-2026-89406

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

CVE-2026-35616-detector.py

CVE-2026-35616 - FortiClient EMS 취약점 탐지기 설명 이 도구는 FortiClient EMS 서버가 CVE-2026-35616 에 취약한지 탐지합니다. 이는 7.4.5부터 7.4.6까지 의 버전에 영향을 미치는 심각한 부적절한 접근 제어 취약점입니다. CVSS 점수: 9.1 치명적 CWE: CWE-284 부적절한 접근 제어 상태: 실제 환경에서 활발히 악용 중 citation:3citation:7 이 취약점은 인증되지 않은 공격자 가 보호된 API 엔드포인트에 접근하고 잠재적으로 서버에서 임의의 명령을...