XSSTRON

XSSTRON, Electron JS Browser To Find XSS Vulnerabilities Powerful Chromium Browser to find XSS Vulnerabilites automatically while browsing web, it can detect many case scenarios with support for POST requests too Installation Install Node.js and npm https://www.npmjs.com/get-npm or sudo apt insta...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

extended-xss-search

Buscador y Finder de XSS Extendido Esta es la versión extendida basada en la idea inicial ya publicada como "xssfinder". Esta versión privada permite a un atacante realizar no solo solicitudes GET sino también POST. Además, es posible proxy cada solicitud a través de Burp u otro túnel. Primeros...

Malicious code in exiouss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805 main.js in [email protected] imports childprocess and issues POST requests to hardcoded endpoints, including https://gemini.google.com and...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit es una herramienta de pruebas de seguridad basada en Python que automatiza la detección de posibles condiciones de RCE en entornos autorizados. Envía solicitudes POST personalizadas a los objetivos, analiza las respuestas del servidor en busca de indicadores d...

EUVD-2026-84536

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

PT-2026-96789

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl. These values are processed through...

SUSE CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

PT-2026-96127

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs when the application fails to properly sanitize the Referer header during POST requests to the 'index.php' endpoint. This allows the value of the header to be copied into the...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

CVE-2026-92586: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38413)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

PT-2026-92060

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3 Description An uncontrolled resource consumption issue exists in the PDFContentScrapingStrategy that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scrapi...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-78083: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86416: Missing Authorization

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...