CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

DSXS

Damn Small XSS Scanner Damn Small XSS Scanner DSXS is a fully functional Cross-site scripting vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

CVE-2024-4577

CVE-2024-4577 A Proof of Concept developed by @watchTowr exploiting the PHP CGI Argument Injection vulnerability CVE-2024-4577 to obtain RCE on a vulnerable PHP version running in a Windows environment. Detailed technical analysis for this vulnerability Orange Tsi 🍊 This vulnerability was found b...

ParamFinder

ParamFinder Discover hidden parameters straight from Caido! Installation Via Community Store Recommended 1. In your Caido, go to the Plugins page 2. Navigate to the Community Store 3. Search for ParamFinder 4. Click Install 5. Done! 🎉 Manual Installation 1. Navigate to the Releases page 2. Downlo...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Gibbon version 22 Reflected Cross Site Scripting XSS Vulnerabilities. https://vulners.com/cve/CVE-2021-40492 A reflected Cross Site Scripting vulnerability exists in multiple pages in version 22 of the Gibbon education application that allows for arbitrary execution ...

param-miner

param-miner This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities. It combines advanced diffing logic from Backslash Powered Scanner with a binary search technique to guess up to 65,000 param names per request. Param names...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable to server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

ParrotSec-Linux-Hardening-Project

ParrotSec Linux - Public Kiosk Project Designing & Implementing A restricted & Trustworthy Environment Hardened kernel - GrSecurity Patched Kernel - PaX Hardening - x PaXctl - x PaXTest - x PaXctld - x Hardened Kernel Runtime Parameters - x Kernel Self Protection Project KSPP - x pti=on - Kernel...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link:...

GetBlocked

GetBlocked! Cleaner pages. Fewer trackers. Local-only. GetBlocked! is a lightweight, local-only Chrome extension that helps reduce common third-party website tracking by blocking known tracker requests, cleaning tracking links, and explaining tracking attempts. An optional experimental Decoy Mode...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Overview This is my research on CVE-2025-2945. This repo includes a test stand with postgress and vulnerable pgadmin, and exploit. CVE Usefull links: NVD Details WIZ Analyze Metasploit Breakdown In pgAdmin backend, which is written in python, there are two endpoint...

CVE-2025-15467

CVE-2025-15467: OpenSSL CMS AuthEnvelopedData Stack Buffer Overflow Overview CVE-2025-15467 is a critical stack buffer overflow vulnerability in OpenSSL's CMS Cryptographic Message Syntax parsing code. The vulnerability exists in the evpciphergetasn1aeadparams function when processing AES-GCM...

BurpSentinel

Burp Sentinel Eases discovery of common security holes in web applications. Intro / tutorial: https://github.com/dobin/BurpSentinel/wiki/BurpSentinel---HowTo-and-introduction Blog: http://dobin.github.io/ With BurpSentinel it is possible for the penetration tester to quickly and easily send a lot...

CVE-2023-24998

When multipartResolver is not defined or StandardServletMultipartResolver is registered Uses FileUpload from Tomcat's internal package In this case, the Tomcat version must be greater than 9.0.71 spring boot 2.7.8 Tomcat's maxParameterCount Default: 10000 setting is injected into...

debugHunter

debugHunter Discover Hidden Debug Endpoints & Development Environments The essential Chrome extension for bug bounty hunters and penetration testers Passively detect debug parameters, sensitive headers, and exposed paths while you browse. Why debugHunter? Finding debug endpoints and exposed...

CVE-2022-34265

CVE-2022-34265 Vulnerability Summary This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookupname argument of...

meowEye

🐾 MeowEye MeowEye is a real-life scanner for multiple web vulnerabilities. It uses a real browser to observe traffic and perform injection-based tests to detect reflective parameters, local file inclusion LFI, and server-side template injection SSTI vulnerabilities for now. In the ToDo list it wi...

redpill

:octocat: Project Description The redpill project aims to assist reverse tcp shells in post-exploration tasks. Often, on redteam appointments we need to use unconventional ways to access the target system, like reverse tcp shells not metasploit in order to bypass the defenses implemented by the...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...