CVE-2019-19919

CVE-2019-19919 Handlebars Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' Vulnerability pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py Enter the target URL: Exploit Expected Output : Ente...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2020-24750

CVE-2020-24750 Result：...

Wonka

Wonka 🍫 "We are the music makers, and we are the dreamers of dreams." - Willy Wonka Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority LSA cache. Like finding a ticket, but for security research and penetration testing! 🎫 ✨ Features 🔐 System...

CVE-2017-1000117

CVE-2017-1000117 PoC Repository for VulApps Fork from joernchen/CVE-2017-1000117 git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git will write the output of id to a file vul in /var/www/html. See More at VulApps...

PoC_CVE-2023-24055

PoCCVE-2023-24055 How to run ? Edit the $User var in the script and replace value with your Username. Open a PowerShell as administrator and run the script : ./PoCCVE-2023-24055.ps1 After the script execution open KeePass. Result is stored under "C:\Users\yourusername\AppData\Local\Temp\output.xm...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC In version 2.0.19 of Flawfinder, no filename sanitization occurs when parsing possibly malicious filenames. Known affected terminals are libvte based, and the example below shows a mate-terminal. This exploit has since been fixed in version 2.0.20 as of 5/17/26 by Davi...

CVE-2025-25461

📌 CVE-2025-25461 - Stored Cross-Site Scripting XSS in SeedDMS 6.0.29 📝 Description A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is...

SpotifyC2

SpotifyC2 — Cloud-Based Command Channel Research Execute commands through a Spotify playlist and receive command output through Telegram. What is SpotifyC2? SpotifyC2 is a Windows-based cybersecurity research project that demonstrates how publicly accessible cloud services can be used as a...

iocx

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

SnafflerParser

Snaffler Output File Parser Especially in large environments, the Snaffler output gets very large and time-consuming to analyze. This script parses the Snaffler output file TSV format required and: Beautifies results into readable tables and exports to TXT, CSV, HTML, JSON or PS Gridview. Generat...

gopassivedns

gopassivedns Network-based DNS logging in Go Summary A network-capture based DNS logger, inspired by https://github.com/gamelinux/passivedns. It uses gopacket to deal with libpcap and packet processing. It outputs JSON logs. It is intended to deal with high volume query capture in environments wi...

CVE-2026-120683

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclienttestimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output...

CVE-2026-120509

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientname' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping...

CVE-2026-111317

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-93429

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions up to and including 1.8.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'guests[][][documents]' parameter. This allows unaut...

EUVD-2026-119166

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note form field whose value is written to post meta note' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping...

CVE-2026-120509 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientname' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping...

CVE-2026-120509

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.1.0 . The root cause is insufficient input sanitization and output escaping of the 'tpro_client_nam...

EUVD-2026-119165

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientname' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping...