CVE-2026-120509

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.1.0 . The root cause is insufficient input sanitization and output escaping of the 'tpro_client_nam...

EUVD-2026-119165

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientname' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping...

EUVD-2026-119163

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-119162

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' default: 'category'' parameter in all versions up to, and including, 4.3.13 due to...

EUVD-2026-119154

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field00' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-120683

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress (versions up to and including 4.1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'tpro_client_testimonial' parameter due to insufficient input sanitiza...

CVE-2026-120683 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclienttestimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output...

EUVD-2026-119147

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclienttestimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output...

shellcode2assembly

ShellcodeToAssembly Replace in shellcodetoasm.py with your shellcode. Endian type is little endian. shellcode = '' Installation git clone https://github.com/blacknbunny/ShellcodeToAssembly.git && cd ShellcodeToAssembly/ && pip2 install -r requirements.txt && python2 shellcodetoasm.py Modules manu...

xori

Xori - Custom disassembly framework Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data. Acknowledgements: Xori wouldn't exist without inspiration and ideas from the open source community. We are indebted to...

CVE-2025-48708

CVE-2025-48708 Description A vulnerability in Artifex Ghostscript before version 10.05.1 causes the plaintext password used to protect a PDF file to be embedded in the output. The issue is due to a lack of argument sanitization in gslibctxstashsanitizedarg base/gslibctx.c, particularly when...

crawpy

Crawpy Yet another content discovery tool written in python. What makes this tool different than others: Sends asynchronous HTTP requests, fast Calibration mode, applies filters on its own Recursive scan mode with additional flags Report generation, you can later go and check your results Multipl...

CVE-2025-63588

CVE-2025-63588 Reflected Cross-Site Scripting XSS in CMSimpleXH cmsimplexh path handling Estimated CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium Assigned CVE: CVE-2025-63588 Products: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Summary A reflected Cross-Site...

ratched

ratched ratched is a Man-in-the-Middle MitM proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SOORIGINALDST sockop...

wanderer

Wanderer Wanderer is an open-source program that collects information about running processes. This information includes the integrity level, the presence of the AMSI as a loaded module, whether it is running as 64-bit or 32-bit as well as the privilege level of the current process. This...

LACheck

LACheck Multithreaded C .NET Assembly Local Administrative Privilege Enumeration Arguments ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10...

usbpcap

USBPcap - USB Packet capture for Windows End-user installer is available at: http://desowin.org/usbpcap Following informations are intended for developers and power users only. Directory overview: USBPcapCMD - sample user space application USBPcapDriver - filter driver used to capture data Build...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

CVE-2026-115811

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'starrating' parameter in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-116558

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/ inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible...