CVE-2026-79770

Nokogiri versions before 1.19.3 are vulnerable to ReDoS (Regular Expression Denial of Service) in the CSS selector tokenizer , specifically in string-literal and identifier tokenization. An attacker who can supply adversarial CSS selectors to methods such as Node#css, Node#at_css, or Searchable#s...

CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

dismember

🔪 Dismember Dismember è un toolkit a riga di comando per Linux che può essere utilizzato per scansionare la memoria di tutti i processi o di alcuni specifici alla ricerca di segreti comuni ed espressioni regolari personalizzate, tra le altre cose. Diventerà presto un toolkit /proc completo. Usand...

CVE-2026-5524-PoC

CVE-2026-5524 — Nicht authentifizierte RCE im Divi Form Builder Massives Exploit-Toolkit für CVE-2026-5524 , eine nicht authentifizierte Schwachstelle zum Hochladen beliebiger Dateien im WordPress-Plugin Divi Form Builder = 5.1.8, die zu Remote-Code-Ausführung führt...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

webpalm

🌐 Traversata Web Avanzata & Estrazione Dati 🚀 🔍 Crawler efficiente, estrazione dati strutturati e visualizzazione connessioni. 🕵️‍♂️ 🗺️ Indice dei contenuti 📦 Installazione ⚡ Caratteristiche 🚀 Utilizzo 📌 Esempi 📜 Pattern Regex 🤝 Contributi ⚡ Caratteristiche 🌳 Generazione di Alberi Web Strutturati...

ator

Authentication Token Obtain and Replace Extender Introduction In the world of web security testing, automation is key, and Burp Suite is the go to choice. However, to truly harness the power of Burp for automated scanning, you need the right plugins. That's where ATOR comes in. This open-source...

endext

EndExt EndExt ist ein .go-Tool zum Extrahieren aller möglichen Endpunkte aus JS-Dateien Idee Wenn du alle JS-Dateien von waybackurls oder ähnlich durchsuchst, oder sogar die JS-Datei-URLs aus der Quellseite der Zielwebsite sammelst .. Falls die Website ein API-System verwendet und du nach allen...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

eviltree

EvilTree A standalone python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those that contain matches. Created for two main reasons: While searching for secrets in files of nested directory structures, being...

eviltree

EvilTree Ein eigenständiger Python3-Nachbau des klassischen „tree“-Befehls mit der zusätzlichen Funktion, nach benutzerdefinierten Schlüsselwörtern/Regex in Dateien zu suchen und diejenigen hervorzuheben, die Übereinstimmungen enthalten. Entwickelt aus zwei Hauptgründen: Bei der Suche nach...

fuzzdb

تم إنشاء FuzzDB لزيادة احتمال اكتشاف ثغرات أمنية في التطبيقات من خلال الاختبار الأمني الديناميكي للتطبيقات. إنه أول وأشمل قاموس مفتوح لأنماط حقن الأعطال، ومواقع الموارد المتوقعة، والتعبيرات النمطية لمطابقة استجابات الخادم. أنماط الهجوم - يحتوي FuzzDB على قوائم شاملة لـ حمولات الهجوم الأولية لاختب...

warcannon

WARCannon - Elaborazione WARC parallela catastroficamente potente WARCannon è stato costruito per semplificare e rendere economico il processo di 'greping su internet'. Con WARCannon puoi: Costruire e testare pattern regex su veri dati Common Crawl Caricare facilmente dataset Common Crawl per...

vBulletin 6.x - Remote Code Execution

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability caused by insufficiently restrictive regex filtering in vB5TemplateRuntime::runMaths, letting unauthenticated remote attackers execute arbitrary PHP code via the pagenavpagenumber parameter in ajax/render...

log4j-scanner-CVE-2021-44228

log4j-scanner CVE-2021-44228 Einfaches Tool zum Scannen ganzer Verzeichnisse auf Versuche von CVE-2021-44228 Es gibt immer Wege, Filter zu umgehen , das Gleiche gilt für die Regex-Muster...

CVE-2022-22978-PoC

CVE 2022-22978: Bypass dell'autorizzazione in RegexRequestMatcher 🥶 Panoramica Secondo le informazioni che ho trovato, questa è una vulnerabilità relativa alla classe RegexRequestMatcher nel framework Spring Security. In particolare, le applicazioni che usano RegexRequestMatcher con un'espression...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Loytec LGATE-902 <6.4.2 - Local File Inclusion

Loytec LGATE-902 versions prior to 6.4.2 suffers from a local file inclusion vulnerability. id: CVE-2018-14916 info: name: Loytec LGATE-902 6.4.2 - Local File Inclusion author: 0xAkoko severity: critical description: Loytec LGATE-902 versions prior to 6.4.2 suffers from a local file inclusion...