extended-xss-search

확장형 XSS 검색 및 찾기 이것은 이미 "xssfinder"로 공개된 초기 아이디어를 기반으로 한 확장 버전입니다. 이 개인 버전은 공격자가 GET뿐만 아니라 POST 요청도 수행할 수 있도록 합니다. 또한 모든 요청을 Burp 또는 다른 터널을 통해 프록시할 수 있습니다. 첫 단계 example.app-settings.conf 파일의 이름을 app-settings.conf 로 변경하고 설정을 조정하세요. 기본적으로 바로 작동해야 하지만, 대상에 따라 청크 크기를 조정하는 것이 좋습니다. 실행 이 도구는 CLI를 통해 인수를...

XSSTRON

XSSTRON, Electron JS 브라우저로 XSS 취약점 찾기 웹을 탐색하는 동안 자동으로 XSS 취약점을 찾는 강력한 Chromium 브라우저, POST 요청도 지원하며 다양한 시나리오를 감지합니다 설치 Node.js와 npm을 설치하세요 https://www.npmjs.com/get-npm 또는 sudo apt install npm 이 저장소 파일을 다운로드하거나 git clone https://github.com/RenwaX23/XSSTRON cd XSSTRON npm install npm start...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

Malicious code in exiouss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805 main.js in [email protected] imports childprocess and issues POST requests to hardcoded endpoints, including https://gemini.google.com and...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit は、Pythonベースのセキュリティテストツールで、認可された環境下のWebアプリケーションにおける潜在的なRCE状態の検出を自動化します。標的に細工されたPOSTリクエストを送信し、実行指標をサーバーレスポンスから分析します。また、カスタム入力によるバッチスキャン、構造化されたペイロード処理、明確なCLI出力をサポートしています。 1. 依存関係のインストール pip install -r requirements.txt 2. エクスプロイトの実行 python3 rceexploit.py target.tx...

EUVD-2026-84536

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

PT-2026-96789

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl. These values are processed through...

SUSE CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

CVE-2026-92586: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38413)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

PT-2026-92060

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3 Description An uncontrolled resource consumption issue exists in the PDFContentScrapingStrategy that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scrapi...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86416: Missing Authorization

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...