XSSTRON

XSSTRON, Electron JS 浏览器，用于发现 XSS 漏洞 强大的 Chromium 浏览器，可在浏览网页时自动发现 XSS 漏洞，支持多种场景，同时支持 POST 请求 安装 root@kitploit: 安装 Node.js 和 npm（https://www.npmjs.com/get-npm）或（sudo apt install npm） 下载本仓库文件或（git clone https://github.com/RenwaX23/XSSTRON） cd XSSTRON npm install npm start 部分使用 Debian/Ubuntu...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

extended-xss-search

Extended XSS Searcher and Finder 这是基于已发布的原始思路 "xssfinder" 的扩展版本。此私有版本允许攻击者不仅执行 GET 请求，还能执行 POST 请求。此外，还可以通过 Burp 或其他隧道代理每个请求。 第一步 将 example.app-settings.conf 重命名为 app-settings.conf 并调整设置。开箱即用通常没问题，但根据目标，我建议调整块大小。 执行 此工具不通过 CLI 接受任何参数，因此只需输入： python3 extended-xss-search.py 配置 可以设置大量选项和设置，以下是一些说明。 ...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit 是一个基于 Python 的安全测试工具，可在授权环境下自动检测 Web 应用程序中潜在的 RCE 条件。它向目标发送精心构造的 POST 请求，分析服务器响应中的执行指标，并支持批量扫描，具有自定义输入、结构化的载荷处理以及清晰的 CLI 输出。 1. 安装依赖 pip install -r requirements.txt 2. 运行漏洞利用 python3 rceexploit.py target.txt "command"...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

next.js: Next.js: Denial of Service via crafted POST requests to server actions

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open,...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...

CVE-2026-66416

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-16910

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

CVE-2026-16910

CVE-2026-16910 describes an SSRF flaw in Red Hat Quay’s notification webhook handlers for Slack and generic webhooks. The handlers accept user-supplied URLs without SSRF validation, enabling a repository administrator to cause the Quay worker to issue POST requests to internal network addresses o...

EUVD-2026-48503

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests

A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP...

CVE-2026-59725

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated...

CVE-2026-56360

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

CVE-2026-56360 n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

PYSEC-2026-916 Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...

CVE-2026-14634

Summary (CVE-2026-14634) The vulnerability exists in kirilkirkov’s Ecommerce-CodeIgniter-Bootstrap (up to commit 213babdbaa949e94557246414db0130e01394517) and affects the function checkForPostRequests in the file application/core/MY_Controller.php for the Subscribed Emails Admin Page. Manipulatio...

CVE-2026-14634

A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the function checkForPostRequests of the file application/core/MYController.php of the component Subscribed Emails Admin Page. Such manipulation...

next.js: Next.js: Denial of Service via crafted POST requests to server actions

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open,...

CVE-2026-53433

A flaw was found in fzf, a command-line fuzzy finder. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a crafted POST request with many small segments to the --listen mode. The inefficient HTTP body processing, which uses repeated string concatenation, leads...