jsfinder

Características | Instalación | Uso | Demo | PENDIENTES| Contacto jsFinder es una herramienta de línea de comandos escrita en Go que escanea páginas web para encontrar archivos JavaScript enlazados en el código fuente HTML. Busca cualquier atributo que pueda contener un archivo JavaScript por...

EUVD-2026-96734

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome DevTools. Recursos...

wappalyzergo

Wappalyzergo Un port ad alte prestazioni della libreria di rilevamento delle tecnologie Wappalyzer in Go. Ispirato da Webanalyze. Utilizza dati da https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Caratteristiche Molto semplice e facile da usare, con una base di...

domato

Domato 🍅 Un fuzzer per il DOM Scritto e mantenuto da Ivan Fratric, [email protected] Copyright 2017 Google Inc. Tutti i diritti riservati. Concesso in licenza secondo l'Apache License, Versione 2.0 la "Licenza"; non è consentito usare questo file se non in conformità con la Licenza. È...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Utilizzo ./lazyrecon.sh -d domain.com Per escludere sottodomini specifici: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com...

PT-2026-110126

Name of the Vulnerable Software and Affected Versions answer-me-with-html versions prior to 0.5.1 Description The software contains a link following issue within the CLI code block src= embedding. The localPath function fails to resolve symlinks, checking only the path text. This allows an attack...

CVE-2026-108723: Improper Link Resolution Before File Access

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external...

PT-2026-110118

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2 Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allow...

CVE-2026-108715: Authorization Bypass Through User-Controlled Key

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

decode-spam-headers

decode-spam-headers.py Che tu stia cercando di capire perché una specifica e-mail è finita in SPAM/Junk per le tue attività amministrative quotidiane o per i tuoi scopi di simulazione di Phishing Red-Team, questo script è qui per aiutarti! L'idea è nata durante la consegna di esercizi commerciali...

EUVD-2026-96305

In Progress® Kendo UI for Vue @progress/kendo-vue-charts starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a...

CVE-2026-106139

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) versions 2.5.0 through 16.2.0 are vulnerable to Cross-Site Scripting (XSS) via the default Chart tooltip. The root cause is that the single-point and shared tooltips render formatted point values as raw HTML without proper encoding. An at...

CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue

In Progress® Kendo UI for Vue @progress/kendo-vue-charts starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a...

CVE-2026-106138 Cross-Site Scripting via Chart Tooltip in KendoReact

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-106138 Cross-Site Scripting via Chart Tooltip in KendoReact

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

EUVD-2026-96304

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-106138

The In Progress® KendoReact (@progress/kendo-react-charts) component versions 1.1.0 through 16.2.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the default Chart tooltip renders formatted point values as raw HTML without proper encoding in both single-point and shared too...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

EUVD-2026-96128

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...