jaeles

!IMPORTANT This repository has been archived and is no longer maintained. Check out github.com/vigolium/vigolium — a brand new scanner that I made that's better in every way. Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner...

vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Deterministic, multi-phase scanning with 317 modules across content discovery, browser/SPA spidering, and...

carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

CVE-2022-29464-mass

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Write by Chocapikk lightely modded by trhacknon Usage root@kitploit: python exploit.py -u or: root@kitploit: python exploit.py -f Zoomeye Dork CLI: root@kitploit: zoomeye search 'title:"WSO2 Management Console"' -num 10...

autoresponder

AutoResponder Herramienta de IR de Carbon Black Response para la caza de amenazas en un entorno ¿Qué es? AutoResponder es una herramienta diseñada para ayudar a las personas a realizar sus tareas de Respuesta a Incidentes CON la ayuda de las increíbles capacidades de Carbon Black Response y SIN...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

Mass-exploit-CVE-2022-29464

Meow Meow Meow! Just a Mass Exploit based on a Python PoC for WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Meow Meow Meow? Requirements? Python3 Shodan Zoomeye A Brain What is this tool? This is a mass-autoscan-exploit of CVE-2022-29464 based on the PoC wrote in python by a...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Full technical analysis will be published at my blog post: https://mr-r3bot.github.io Usage root@kitploit: python exploit.py -u...

WSO2-2020-0731

WSO2-2020-0731: XXE and XSS vulnerabilities in WSO2 Carbon A potential XXE and XSS have been identified in multiple WSO2 Products. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor requested a CVE for these...

MAL-005

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the "Carbon Applications" add feature of WSO2 ESB. Remote code execution may be obtained by writing/overwriting specific files. Why no CVE? The vendor replied tha...

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2025-12737

CVE-2025-12737 affects WSO2 products via the Carbon Console . Administrative operations within the console do not adequately validate specific user-supplied input, allowing a threat actor with administrative privileges to inject and execute arbitrary code remotely , leading to complete compromise...

EUVD-2025-210842

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2026-0637

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394

The CVE-2025-13394 entry describes a CSRF issue in the Carbon console's Ajax processor. State-changing operations are performed via HTTP GET, and while SameSite=Lax cookies are used, this mitigation is bypassed for cross-origin top-level navigation, allowing an authenticated user’s browser to tri...