DSXS

Damn Small XSS Scanner Damn Small XSS Scanner DSXS est un scanner de vulnérabilités Cross-site scripting entièrement fonctionnel prenant en charge les paramètres GET et POST écrit en moins de 100 lignes de code. En ce qui concerne les paramètres optionnels, il prend en charge le proxy HTTP ainsi...

ParamPamPam

ParamPamPam Этот инструмент для брутфорс-обнаружения GET и POST параметров. Установка С помощью Docker Установите Docker git clone https://github.com/Bo0oM/ParamPamPam.git cd ParamPamPam docker build -t parampp . echo -e '!'"/bin/bash\ndocker run -ti --rm parampp $@" /usr/local/bin/parampp paramp...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS est un scanner de vulnérabilité d'injection SQL entièrement fonctionnel supportant les paramètres GET et POST écrit en moins de 100 lignes de code. En ce qui concerne les paramètres optionnels, il supporte le proxy HTTP ainsi que les valeurs...

CVE-2024-48245

CVE-2024-48245 Уязвимость SQL-инъекции в Vehicle Management System 1.0 - 1.3 Описание Vehicle Management System 1.0 уязвим к SQL-инъекциям. Гостевые пользователи с низким уровнем аутентификации или административные учетные записи могут использовать уязвимые POST-параметры в нескольких конечных...

CVE-2022-25845-In-Spring

CVE-2022-25845-In-Spring !IMPORTANT Usage éducatif uniquement, ne pas utiliser à des fins illégales exploit by python Si cela vous aide, laissez une étoile Référence : https://github.com/luelueking/CVE-2022-25845-In-Spring Usage Modifiez la logique de passage des paramètres selon vos besoins ; ic...

CVE-2024-57427

CVE-2024-57427 - Cross-Site Scripting Réfléchi XSS PHPJabbers Cinema Booking System v2.0 est vulnérable à un cross-site scripting réfléchi XSS. Plusieurs points de terminaison gèrent incorrectement les entrées utilisateur, permettant à des scripts malveillants de s'exécuter dans le navigateur de ...

CVE-2026-7848 SQL Injection in Alior Bank raty PrestaShop module

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

EUVD-2026-77518

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268

QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...

CVE-2026-89268: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

PT-2026-90554

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-75126

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation:...

EUVD-2026-67786

PLANET GS-4210-16P2S firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation:...

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

CVE-2026-75126: Stack-based Buffer Overflow

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation:...

CVE-2026-15996 Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...

CVE-2026-71248: Improper Neutralization of Special Elements used in an SQL Command

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...

CVE-2026-65707

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-65707

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...