shlol

SHLOL This is a menu you can trigger with a keybind to do basic stuff for you Really easy to use Create listeners on the fly No copy pasting needed Choose the type, IP and PORT and you are done! Run remote scripts easily Reverse Shell Generator...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

CVE-2026-120636

A flaw was found in perl-cgi. The component constructs target URLs and form actions from client-supplied request values without sufficient validation. A remote attacker can exploit this flaw by sending a specially crafted request URI Uniform Resource Identifier containing arbitrary domains or...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads hxxps://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

MAL-2026-18455 Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads hxxps://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa syntax: title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML...

ipyida

= IPyIDA IPyIDA is a python-only solution to add an IPython console to IDA Pro. Use to open a window with an embedded Qt console. You can then benefit from IPython's autocompletion, online help, monospaced font input field, graphs, and so on. You can also connect to the kernel outside of IDA usin...

CVE-2023-08-21-exploit

Exploit Title: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie = new URLxhr1.responseURL.search.split"="1; xhr2.open'PATCH',...

CVE-2026-51990

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

MAL-2026-18405 Malicious code in log-utils-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e04ec7e9e18068a3876db982defaaa4710d22d8bf619e65f6976b8cf7ddd3e9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

Malicious code in netweavex (PyPI)

Source: kam193 96ae0ec579e95e33c63930792ee782e6229f77547efac35c3894a7e05c8af2ca Clone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder. --- Category: MALICIOUS - The campaign has...

MAL-2026-18328 Malicious code in netweavex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples including the import netweavex a...

Malicious code in netweavex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples including the import netweavex a...

Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5428d0f2f07674817697574b1993211dfa902bad746d8cd6efc1ad6b1fbbfd90 nebulallm 1.4.3 presents itself as an AI API client stub but ships a custom install command class in setup.py that executes on pip install. The insta...