PyFlooder

PyFlooder An HTTP Flood Python script that could stop a normal website in 10s How does it work ? It generates a configurable number of random GET requests and sends them to the target Usage pyflooder.py...

log4j-scan

1 Usage Instructions CVE-2021-44228 log4j 2.x rce vulnerability detection tool, sends GET requests to the target URL and uses DNSlog to check for responses. $ python3 log4j-scan.py -h Usage: python log4j-scan.py -u Options: -h, --help show this help message and exit -u URL, --url=URL 输入需要检查的链接，如:...

extended-xss-search

Extended XSS Searcher and Finder This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First...

CVE-2026-33340

CVE-2026-33340: SSRF in lollms-webui Overview Field| Detail ---|--- CVE ID| CVE-2026-33340 Vulnerability| Server-Side Request Forgery SSRF Affected Product| ParisNeo/lollms-webui LoLLMs WEBUI Severity| Critical — CVSS 9.1 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918:...

MalleableC2Profiles

MalleableC2Profiles Malleable C2 profiles for Cobalt Strike version 3.6+ bingsearchgetonly.profile - Bing web search profile, uses GET requests only cnnvideogetonly.profile - MSNBC live video straming profile, uses GET requests only googledrivegetonly.profile - Google Drive document viewer...

SQLi_Sleeps

SQLiSleeps It is a simple script that allows to find SQLi vulnerabilities, obtaining the response time greater than 20 seconds per medium and time-based injection. usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos. options: -h, --hel...

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can...

CVE-2026-126464

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-126323 Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET...

CVE-2026-126323 Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET...

CVE-2026-126464 OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

EUVD-2026-124960

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-59080

Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assesse...

EUVD-2026-124882

Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assesse...

CVE-2026-127141

SOGo versions prior to 5.12.13 are vulnerable to a denial of service (DoS) attack. An authenticated attacker can exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but fails to send an IMAP greeting response . By ...

CVE-2026-127141 SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait

SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can iss...

CVE-2026-118411

Cross-Site Request Forgery CSRF in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions...

CVE-2026-118411 Apache Roller: Cross-site request forgery through GET requests to administrative actions

Cross-Site Request Forgery CSRF in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions...

CVE-2026-118411 Apache Roller: Cross-site request forgery through GET requests to administrative actions

Cross-Site Request Forgery CSRF in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions...

CVE-2026-118411

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Roller versions 5.0.1 through 6.1.6 . The root cause is that the application's request-token check is only applied to POST requests, while administrative actions also accept GET requests. This allows an unauthenticated attacker to...