CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

Security Bulletin: IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (CVE-2026-7366)

Summary IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall CVE-2026-7366 Vulnerability Details CVEID:CVE-2026-7366 DESCRIPTION: IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 throug...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105218

Versions of gopay prior to 1.5.119 are vulnerable to a Man-in-the-Middle (MitM) attack due to disabled TLS certificate verification within the defaultClient() function in pkg/xhttp/client.go. An attacker can intercept communications by presenting any certificate to read sensitive merchant credent...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2025-7775

CVE-2025-7775 Version detection PowerShell There's also a cool file hash based method: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py You can also potentially use the client binaries to enumerate the version not sure if you need auth... not looked at...

CVE-2024-23897

Using the client The general syntax for invoking the client is as follows: java -jar jenkins-cli.jar -s JENKINSURL global options... command command options... arguments... info :- https://www.jenkins.io/doc/book/managing/cli/downloading-the-client CVE :-...

Chrome-Skia-CVE-2024-8198

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

CVE-2016-4971

CVE-2016-4971 CVE-2016-4971 Wget 1.18/1.14-13.el7 Client Exploit Wget 1.18 Arbitrary File Upload Exploit AND Wget 1.14-13.el7 Arbitrary File Upload Exploit Modifications by: mbadanoiu Original Exploit Dawid Golunski dawid at legalhackers.com...

CVE-2021-4191_Exploits

CVE-2021-4191Exploits pip install python-graphql-client Usage: python3 gitlabenum.py --rurl http://10.0.0.6/api/graphql Copyrights: https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/...

CVE-2024-23113

CVE-2024-23113 Este script de Python busca en una lista de clientes para ver si su dispositivo FortiGate es vulnerable a este CVE. Cómo Usar 1. Crea un archivo "clients.txt" e importa una lista con las direcciones IP de todos tus clientes. 2. Crea un archivo "vul.txt". Se utilizará para exportar...

cs-get-last-error

cs-get-last-error Obtén mensajes de error a partir de los códigos de GetLastError directamente dentro del cliente de Cobalt Strike, sin la ayuda de la búsqueda de Google, net helpmsg ni Microsoft Error Lookup Tool. Los mensajes de error están incluidos en el script aggressor y no se requiere...

ecs_checker

EDNS Client Subnet ECS Remote Detection Tool - CVE-2025-40766 This tool checks whether a remote DNS resolver supports EDNS Client Subnet ECS — a DNS extension that may expose systems to cache poisoning or information leakage vulnerabilities such as CVE-2025-40766. 🔍 What It Does Sends a DNS query...

CVE-2025-30349

Horde IMP vulnerability – obfuscation via HTML encoding – XSS payload Horde 5.2.23; IMP 6.2.27 The details of the vulnerability are explained in Details.md file. The PoC creates and send an email with payload exploiting the vulnerability to the recipient. This kind of email has to be viewed in a...

CVE-2025-52385

CVE-2025-52385 Software : Studio 3T v.2025.1.0 Vulnerability Report : Studio 3T Remote Command Execution Overview A critical vulnerability in Studio 3T version 2025.1.0 and earlier allows a remote attacker to execute arbitrary code via a crafted payload exploiting the childprocess module in the...

CVE-2016-2233

CVE-2016-2233 CVE-2016-2233 is a stack-based buffer overflow vulnerability related with a wide-used IRC software Hexchat. We build a IRC server and launch the attack on it to make all the client connected to the server crash. We exploited our attack on Ubuntu 12.04 using Python. We make a patch t...

CVE-2024-55968

CVE-2024-55968 POC for DTEX LPE CVE-2024-55968 Affected product: DEC-M DTEX Forwarder version 6.1.1. DTEX is a unified insider risk management platform. Affected component: DEC-M EventReportingService XPC Helper Attack vector: The DTEX Event Reporting Service was found with a privileged XPC helpe...

nextcloud_android

Nextcloud Android app Codacy Badge The Android client forNextcloud. Easily work with your data on your Nextcloud. How to contribute If you want to contribute to Nextcloud, you are very welcome: on our IRC channels and on freenode our forum at https://help.nextcloud.com for translations of the app...