CVE-2026-89277

The CAI Content Credentials software is vulnerable to an Integer Overflow or Wraparound (CWE-190) vulnerability. An attacker could exploit this flaw to cause an application crash, resulting in a denial-of-service (DoS) condition. Exploitation requires user interaction, such as a victim visiting a...

CVE-2026-75638

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20). This flaw could allow an attacker to bypass security features and obtain unauthorized write access . Successful exploitation requires user interaction , such as a victim visiting a maliciously...

EUVD-2026-84764

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

CVE-2026-76194 CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

CVE-2026-76194

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to a Security feature bypass . An attacker could exploit this to gain unauthorized limited write access by tricking a victim into visiting a maliciously crafted URL or interacti...

CVE-2023-34845

CVE-2023-34845 POC de vulnerabilidad para CVE-2023-34845 Vulnerabilidad Encontré un ataque de cross-site scripting en la página de creación de nuevo contenido http://localhost:800/admin/new-content esto ejecutará el script en el contexto del usuario, permitiendo al atacante acceder a cualquier...

uBlockOrigin-HUGE-AI-Blocklist

uBlockOrigin 和 uBlacklist 大型 AI 黑名单 一份精心整理的大型网站黑名单（1000+），这些网站包含 AI 生成内容，用于通过 uBlock Origin 或 uBlacklist 清理图片搜索引擎（Google Search、DuckDuckGo 和 Bing）。 同样适用于移动设备（iOS、iPadOS 、Android ）通过 uBlacklist，以及通过 pi-hole/adguard（通过 Hosts 文件）。 PC/桌面端安装 使用 uBlock Origin 安装 一键导入（任何平台） 如果你已安装 uBlock...

subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

PhantomFS

PhantomFS Proveedor de ProjFS. Proyecta archivos cuyo contenido depende de qué proceso los lee. El payload se almacena cifrado con AES-256-CBC en disco, descifrado solo en memoria en tiempo de ejecución. Esto no debería evadir ningún EDR, ya que el payload se escribirá en disco cuando procesos...

CVE-2026-74939-escape-the-mac-n-cheese-box

CVE-2026-74939 — escalada de privilegios content→parent en Firefox Prueba de concepto para una evasión del sandbox en Firefox 149.0a1 nightly 2fbc0748c4, anterior al parche. Un proceso de contenido comprometido falsifica un mensaje IPDL que hace que el parent cargue una página en un proceso...

demiguise

Demiguise - HTA 加密工具 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.trust/ 由 Richard Warren 开发, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise 基于 AGPL 发布，详见 LICENSE 文件 它的作用是什么？ 该项目的目标是生成.html文件，这些文件 包含一个加密的 HTA 文件 。其思路是，当目标访问页面时，获取密钥，并在浏览器中动态解密...

Better-CVE-2022-29464

Mejor CVE-2022-29464 Ciertos productos WSO2 permiten la subida de archivos sin restricciones, lo que resulta en la ejecución remota de código. El atacante debe usar un endpoint /fileupload con una secuencia de directory traversal en Content-Disposition para alcanzar un directorio bajo la raíz web...

CVE-2022-42094

Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Card. Vectores de ataque: El atacante debe publicar algo en el "Card content" e insertar el payload...

Learn-Web-Hacking

Web安全学习笔记 README English version 笔记链接 序 笔者在学习Web安全的过程中，深切地感受到相关的知识浩如烟海，而且很大一部分知识点都相对零散，如果没有相对清晰的脉络作为参考，会给学习带来一些不必要的负担。因此，在对Web安全有了浅薄的了解之后，尝试把一些知识、想法整理记录下来，最后形成了这份笔记，希望能够为正在入门的网络安全爱好者提供一定的帮助。...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

ThreatExchange

Projects in this Repository This repository originally started as code to support Meta's ThreatExchange API, but over time has grown to include a number of projects to support signal exchange and content moderation in general. Below are a list of sub-projects. PDQ Image Hashing and Similarity...

CVE-2022-42096

Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Post. Vectores de ataque: El atacante debe publicar algo en "Post content" e insertar el payload XSS...

CheatSheetHost

CheatSheetHost 一个轻量级的、内容驱动的 Web 服务器，用于托管交互式速查表和参考资料。非常适合 CTF（夺旗赛）挑战、逆向工程和技术文档。当您希望在实验室环境中限制或避免外部流量，同时仍能访问有用资料时，这是最佳选择。 我已对脚本进行了一些加固，但您在使用前应进行审查，并/或在实验室环境中部署 特性 简单的 JSON 内容 ：使用易于编辑的 JSON 文件定义速查表 响应式设计 ：在桌面、平板和移动设备上均能工作 复古终端主题 ：怀旧的绿色文字黑色背景 CRT 显示器风格 局域网可访问 ：在本地网络内共享速查表 多种章节类型 ：表格、文本块、代码片段和 ASCII 表...

OpenCRE

OpenCRE Go to https://www.opencre.org to see OpenCRE working and more explanation. OpenCRE stands for Open Common Requirement enumeration. It is an interactive content linking platform for uniting security standards and guidelines. It offers easy and robust access to relevant information when...

WhatTheHack

What The Hack - 仓库 欢迎来到 GitHub 上的 What The Hack 仓库。本仓库包含专为计划在组织内举办 What The Hack 活动的教练设计的指导内容。 如果你是一个有兴趣参加或举办 What The Hack 活动的组织，请访问 What The Hack 网站，地址为：https://aka.ms/wth 如果你是参加 What The Hack 活动的学员，请前往What The Hack 网站。 什么是 What The Hack？ "What The Hack" 是一系列基于挑战的黑客马拉松，可以在线下或通过 Microsoft Teams...