EUVD-2026-91476

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

beacon_health_check

Script de Agresor para Health Check de Beacon Joe Vest Twitter: @joevest Descripción Este script de agresor utiliza el campo de nota de un beacon para indicar el estado de salud del beacon. Esto se logra mediante: Rastreando el tiempo de sueño/jitter actual de cada beacon Calculando la salud basa...

jwt-key-id-injector

Inyector de ID de Clave JWT Script simple de Python para verificar una vulnerabilidad hipotética de JWT. Supongamos que hay una aplicación que utiliza tokens JWT firmados con el algoritmo HS256. Un token de ejemplo se ve así:...

CVE-2025-45778

CVE-2025-45778 CVE-2025-45778: XSS Almacenado Autenticado. Una vulnerabilidad de cross-site scripting XSS almacenado autenticado en The Language Sloth Web Application v1.0 permite a los atacantes ejecutar código JavaScript o HTML arbitrario mediante la inyección de un payload manipulado en el cam...

CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field

Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft openclaw-dashboard Title: OpenClaw Dashboard Stored XSS via lastMessage Session Field CVE ID: CVE-2026-66421 https://github.com/tugcantopaloglu/openclaw-dashboard Summary The sessions table on the...

CVE-2017-7529

Vulnerabilidad de desbordamiento de enteros en Nginx CVE-2017-7529 Información de la vulnerabilidad Cuando se utilizan los módulos estándar de nginx, un atacante puede obtener la información del encabezado de los archivos en caché de la respuesta enviando solicitudes de cabecera header que...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC for CVE-2026-64638 Educational Proof of Concept for the XSS2Shell chain CVE-2026-64638, a pre-authentication XSS → RCE vulnerability in WordPress Core discovered independently by pwn.ai and disclosed on August 7, 2026. Table of contents 1. Executive Summary 2. Legal notice 3. Chai...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

auto-cve-2022-44268.sh

auto-cve-2022-44268 Automatizando la explotación de CVE-2022-44268 ImageMagick Arbitrary File Read Hallazgo original: https://www.metabaseq.com/imagemagick-zero-days/ Repositorio del PoC: https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC Descripción ImageMagick...

directus-security

directus-security Audita cualquier instancia de Directus para detectar las configuraciones incorrectas que realmente filtran datos: exposición de lectura del rol público, enumeración de usuarios, fugas de versión/esquema sin autenticación, introspección de GraphQL y el oráculo de enumeración de...

CVE-2023-6019

CVE-2023-6019 - Anyscale Ray Dashboard RCE no autenticada PoC exploit para CVE-2023-6019 — Ejecución remota de código a través de la API de trabajos del Ray Dashboard sin autenticación. Creado por oguiii Descripción Anyscale Ray es un framework de código abierto para cargas de trabajo distribuida...

EUVD-2026-91250

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-96566

The Newsletter – Send awesome emails from WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.4.0 . The root cause is insufficient input sanitization and output escaping within the 'np1' Custom Field Parameter . Unauthenticated attackers can i...

CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 13.2.0 . The root cause is insufficient input sanitization and output escaping involving the '{{GET:}}' Dynamic Placeholder . Specifica...

CVE-2026-93880 Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

recon-skills

🛡️ Recon & Pentest Skill Pack 169 offensive security skills for recon and pentest. Field-validated techniques from 600+ company targets across 45+ sectors. Updated with browser fingerprint evasion, anti-bot bypass, hardcoded credential hunting, SCADA/ICS enumeration. 📖 Blog & research: hiago.sh —...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – SMTP Header Injection in Contact Form Program Code Python contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender = request.form'email' message =...

GraphQLmap

GraphQLmap GraphQLmap es un motor de scripting para interactuar con un endpoint GraphQL con fines de pruebas de penetración. Instalación Características y ejemplos Volcar un esquema GraphQL Interactuar con un endpoint GraphQL Ejecutar consultas GraphQL Autocompletar consultas Fuzzing de campos...