ShunyaNet-Sentinel

ShunyaNet Sentinel UPDATED: 03/02/2026 ShunyaNet Sentinel is a lightweight, cyberpunk-themed program that ingests RSS feeds e.g., breaking news, social media, sends them to an LLM for analysis, and delivers alerts and summary reports directly to the GUI and Slack at regular intervals. The project...

CVE-2026-54339

Glean , a self-hosted RSS reader and personal knowledge management tool, is affected by a non-blind SSRF with full response disclosure in versions prior to 0.2.6 . An attacker who can POST a malicious feed URL to /api/feeds/discover causes the background worker to fetch each item link without net...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

peer-tweet

PeerTweet BitTorrentのDHTを使用した分散型フィード。ArvidとThe8472のアイデア「DHT RSSフィード」http://libtorrent.org/dhtrss.html スクリーンショット クイックリンク 最新のバイナリはリリースページからダウンロードしてください。 PeerTweetアドレスはアドレス一覧のイシューページで見つけて共有してください。 PeerTweetとは？ BitTorrentのDHTは、おそらくインターネット上で最も耐障害性が高く、検閲耐性のあるネットワークの一つです。PeerTweetはこのネットワークを使用して、ユーザーが ツイ...

CVE-2023-5612

Tags RSS フィードにおける公開メールアドレスの開示 https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ root@kitploit: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user...

CVE-2025-24893

XWiki SSTI エクスプロイト SolrSearch エンドポイントの Groovy テンプレートインジェクションを介して、XWiki Server-Side Template Injection SSTI の脆弱性を悪用する Python エクスプロイトです。 脆弱性 タイプ : サーバーサイドテンプレートインジェクション SSTI コンポーネント : XWiki SolrSearch RSS フィード 影響 : リモートコード実行 影響を受けるバージョン : XWiki 15.10.8 およびその他の可能性あり 要件 root@kitploit: pip3 install...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI 导致未认证 RCE 一个自包含的 Docker 实验环境，用于复现 CVE-2025-24893——XWiki SolrSearch RSS 源中的服务端模板注入（Server-Side Template Injection，SSTI），该漏洞可导致未认证的远程代码执行（RCE）。它运行存在漏洞的 15.10.10 版本和已修复的 15.10.11 版本，因此可以展示同一个请求在一个版本上成功、在另一个版本上失败。 关于 AI 工具使用的说明。 在准备本项目时，我有限地使用了两个 AI 助手——Anthropi...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 エクスプロイト Kirby 3.9.6 XML External Entity CVE-2023-38490 / GHSA-q386-w6fg-gmgp のエクスプロイト エクスプロイトデモ 脆弱なデモアプリをビルドして実行: root@kitploit: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p 127.0.0.2:1337:80/tcp --name CVE-2023-384...

DRUPAL-CONTRIB-2026-137

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

EUVD-2026-70392

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-82657 Admidio before 5.0.12 Authentication Bypass via RSS feeds

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post...

PT-2026-83583

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description The software fails to enforce login-only module restrictions within the RSS feed endpoints for the forum and announcements modules. This allows unauthenticated attackers to retrieve forum topics and...

EUVD-2026-67864

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

CVE-2026-55248

plone.app.portlets (Plone CMS) is vulnerable to three issues in its RSS feed portlet, all fixed in versions 5.0.8, 6.0.4, and 7.0.2 . A low-privileged member can set the RSS feed URL to a very large response, causing excessive in-memory data retention and denial of service via the FEED_DATA cache...

CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

CVE-2026-77507

Weblate , a web-based continuous localization platform, is affected by an information disclosure vulnerability in its object-scoped RSS feeds prior to version 2026.8 . The root cause is that these feeds fail to enforce the permission checks applied elsewhere, allowing unauthorized users to read c...

CVE-2026-79663

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...