CVE-2026-115411 crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

CVE-2026-115411

The crawlseo crawler engine (versions before 0.2.4 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the isPrivateIp() function fails to block specific reserved IP ranges, including RFC 6598 Carrier-Grade NAT , RFC 6890 , and TEST-NET ranges. Furthermore, the engine...

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

Exploit-Post-Exploitation

🛡️ LAB 13 Exploitation & Post-Exploitation Cybersecurit...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

recon

The project has moved to monorepo. See https://github.com/pownjs/pown for more information. Recon Recon is a target reconnaissance framework powered by knowledge graphs. Using knowledge graphs instead of flat table representation is easier to find the relationships between different types of...

dr_robot

. . . . . . . : \ : \ : \ : . \ : / : . \ \ :| | | || || || : | || | \ | : | | | :| | . | || : \ | : \ | : || | | : | | | |. / | || |\ . / |/ . / | | :/ || || :/ :/ || : : : Copyright 2019 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of Contract...

CVE-2026-94621 AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated...

CVE-2026-94621

The AliasVault password manager server API is vulnerable to Server-Side Request Forgery (SSRF) via DNS rebinding in its favicon extractor. Prior to version 0.30.3 , the server performs an initial DNS lookup for validation but allows a second lookup during the HTTP connection. An authenticated low...

CVE-2026-94621 AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated...

CVE-2026-55875

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-55875

Helium, a student planner, is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.60 . An authenticated user can submit an arbitrary URL to the POST /feed/externalcalendars/ endpoint. The application's icalexternalcalendarservice.py script validates only the URL syntax befor...

CVE-2026-55875: Server-Side Request Forgery (SSRF)

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-94621: Time-of-check Time-of-use (TOCTOU) Race Condition

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated...

shodan

Shodan Dorks por twitter.com/lothos612 Siéntete libre de hacer sugerencias Shodan Dorks Filtros básicos de Shodan city: Encuentra dispositivos en una ciudad específica. city:"Bangalore" country: Encuentra dispositivos en un país específico. country:"IN" geo: Encuentra dispositivos mediante...

evine

Evine Web Crawler CLI interactivo. Evine es un web crawler y web scraper simple, rápido e interactivo escrito en Golang. Evine es útil para una amplia gama de propósitos, como extracción de metadatos y datos, minería de datos, reconocimiento y pruebas. Si te gusta el proyecto, dale una estrella...

amass

Proyecto OWASP Amass El Proyecto OWASP Amass realiza mapeo de redes de superficies de ataque y descubrimiento de activos externos utilizando técnicas de recopilación de información de fuentes abiertas y reconocimiento activo. Instalación Puedes encontrar instrucciones adicionales de instalación y...

uddup

UDdup - Herramienta de Deduplicación de URLs La herramienta obtiene una lista de URLs y elimina páginas "duplicadas" en el sentido de patrones de URL que probablemente sean repetitivos y apunten a la misma plantilla web. Por ejemplo: https://www.example.com/product/123...