API-s-for-OSINT

APIs Para OSINT Esta es una colección de APIs que serán útiles para automatizar diversas tareas en OSINT. Instrucción para principiantes totales: Automatización de OSINT: usando funciones personalizadas para trabajar con solicitudes de API en Google Sheets ¡Gracias por seguirme!...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner es una herramienta potente y fácil de usar diseñada para identificar posibles vulnerabilidades en sitios de WordPress inspeccionando sus endpoints de API. El escáner tiene como objetivo ayudar a propietarios de sitios web, desarrolladores y...

py3webfuzz

Py3webFuzz ';-- Python Biblioteca de módulo de fuzzing web Python3 Module Compatible Autor Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contribuyentes Nathan Hamiel @nathanhamiel DESCRIPCIÓN Basado en pywebfuzz, Py3webfuzz es un módulo de Python3 que ayuda a identifica...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

rewerse-engineering

rewerse engineering Un cliente no oficial de la API de REWE en Go y Python. Implementa los endpoints de acceso público sin autenticación que la app de REWE utiliza para consultar descuentos actuales Angebote, productos, mercados y retiradas de productos. Versión de APK compatible actualmente:...

EUVD-2026-91832

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — Acceso no autenticado de lectura/escritura a la API de AI Scanner de CyberPanel Plantilla de detección de Nuclei para CVE-2026-41473 que afecta a versiones de CyberPanel anteriores a 2.4.4. Vulnerabilidad La función AI Scanner de CyberPanel expone dos endpoints de API sin...

CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Configuración incorrecta de CORS en Halo CMS + Bypass de Protección CSRF — Ataque Combinado Resumen Existe una vulnerabilidad crítica de ataque combinado en las versiones de Halo CMS hasta la 2.25.4 debido a dos configuraciones de seguridad incorrectas: 1. Configuración incorrecta...

CVE-2026-35616-detector.py

CVE-2026-35616 - Detector de Vulnerabilidades en FortiClient EMS Descripción Esta herramienta detecta si un servidor FortiClient EMS es vulnerable a CVE-2026-35616 , una vulnerabilidad crítica de control de acceso inadecuado que afecta a las versiones 7.4.5 hasta 7.4.6. Puntuación CVSS: 9.1 Críti...

CVE-2026-67172

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-35616

CVE-2026-35616 — Bypass de Pre-Autenticación en FortiClient EMS Prueba de Concepto PoC para el bypass de autenticación en FortiClient Endpoint Management Server CVE-2026-35616 Este script explota una vulnerabilidad de bypass de autenticación en FortiClient EMS que permite acceso no autenticado a...

CVE-2026-67172

HCL BigFix Service Management is affected by an Information Disclosure vulnerability. The application returns sensitive information within error messages when invalid inputs are submitted to specific API endpoints . This exposure could potentially be used by an attacker to facilitate subsequent a...

CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

EUVD-2026-90904

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...