28671 matches found
CVE-2026-104926
The WooCommerce Extra Product Options Pro plugin for WordPress (versions up to and including 3.3.2 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the _start and _end parameters. Unauthenticated attack...
EUVD-2026-114697
The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start / end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2026-104926: ThemeHigh WooCommerce Extra Product Options Pro: The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…
The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ' start / end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
news-8.6.0-cve-2026-8726-backport
Security backport for georgringer/news 8.6.0 This repository contains a minimal backport for CVE-2026-8726 / TYPO3-EXT-SA-2026-010 , a high-severity SQL injection vulnerability in the TYPO3 extension georgringer/news. It is intended only for installations that must temporarily remain on news 8.6....
bbrecon
This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...
pepeScraper
pepeScraper - 4chan scraper A complete scraper for 4chan Now that's fast. pepeScraper is a scraper that uses context for your searches and returns exactly what you want. I'm learning how to make an item look cooler than it actually is Enter keywords, anything you can think of just be careful what...
CVE-2022-34265
CVE-2022-34265 Usage start docker-compose build docker-compose up -d stop docker-compose down PoC verification of Django vulnerability CVE-2022-34265 A vulnerability CVE-2022-34265 in Django was disclosed on July 5, 2022 US time. This article describes our discussion of this vulnerability and the...
active_c2_ioc_public
+OPTIONS: ^: +TITLE: Active C2 IOCs Note Be careful with the firstseen/lastseen dates in each entry. Don't judge based on just an IP address...
urlhunter
o Utku Sen's /\o Oo |/ =- .===O- URL -O- / /U' hunter /|\ || |/ \ | utkusen.com |K || twitter.com/utkusenen urlhunter is a recon tool that allows searching on URLs that are exposed via shortener services such as bit.ly and goo.gl. The project is written in Go. How? A group named URLTeam kudos...
CVE-2022-34265
CVE-2022-34265 Vulnerability Summary This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookupname argument of...
ssl-certificate-expiry-date-checker
sslcertificateexpirydatechecker Find out which cerificate will expire and need to renew. Find various information from scan result expire date, issuer, signature, serial number... If you are ssl cerificate manager in your organization, collect the list from your coworker, teams, and check the...
Azure-AD-Password-Checker
Azure AD Password Checker In an Azure AD environment, it's possible to determine whether a user has Multi-Factor Authentication MFA disabled without requiring any special privileges. This can be accomplished by analyzing the account's creation date and last password change date. If an account's...
CVE-2021-30809-OOM
CVE-2021-30809 — Apple WebKit Use-After-Free Vulnerability Crash PoC https://github.com/user-attachments/assets/e81f8a01-d48d-44cc-a38f-ce59b01222d5 Overview This repository contains a minimal crash-inducing harness for CVE-2021-30809, a use-after-free UAF vulnerability in WebKit. The PoC exercis...
CVE-2025-2907
CVE-2025-2907 Exploit Details Published : 2025-04-04 Updated : 2025-03-28 Severity : Critical CVSS Score: 9.8 CWE : CWE-862: CWE-862 Missing Authorization Affected Versions : All versions from n/a through 12.3.1 Researcher :...
GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing
A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...
MAL-2026-18369 Malicious code in mui-wrapper-x-date-pickers (npm)
mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...
Malicious code in mui-wrapper-x-date-pickers (npm)
mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...
Lotus Domino R5 and R6 WebMail - Information Disclosure
Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...