CheatSheetHost

CheatSheetHost A lightweight, content-driven web server for hosting interactive cheatsheets and reference materials. Perfect for CTF Capture The Flag challenges, reverse engineering, and technical documentation. This is best used in labs where you want to limit or forgo external traffic while sti...

burp-jq

Burp JQ This is a Burp Extension to apply jq queries to JSON content from the HTTP message viewer. Build $ gradle fatJar Credits Burp JQ relies on jackson-jq, a Java implementation of jq. jq jackson jackson-jq...

OWASP__json-sanitizer_CVE-2020-13973_1-2-0

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

CVE-2026-119751

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

CVE-2026-119751 Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

EUVD-2026-117550

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

CVE-2026-119751

The Content Egg plugin for WordPress before version 12.1.0 is vulnerable to an unauthenticated information disclosure due to broken access control. The issue resides in the permission_check() function of the REST route POST /wp-json/content-egg/v1/render-blocks, which incorrectly returns true if ...

CVE-2025-65881

CVE-2025-65881 The Project Zoo Management System v1.00 is vulnerable to Cross-site scripting XSS on /zms/classes/Login.php?f=login due to: 1. Invalid Content-type of JSON Responses on /zms/classes/Login.php?f=login 2. Unsanitized User Input in Responses Allowing unauthenticated attackers to injec...

CVE-2026-104906

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

EUVD-2026-91742

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

PT-2026-104361

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

EUVD-2026-88654

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

PT-2026-102457

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...

CVE-2026-101169: Deserialization of Untrusted Data

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2022-28108

Selenium Chrome RCE Exploit Extended This repository contains a modified version of a Metasploit module that exploits a Remote Code Execution vulnerability in older versions of Selenium Server Grid. Please read this README carefully before using this code. Acknowledgment of Original Code: This...

PT-2026-93877

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...