bambdas

Bambda スクリプト PortSwigger 公式 Bambda スクリプトリポジトリへようこそ。このリポジトリには、PortSwigger とコミュニティの両方によって開発されたスクリプト集が含まれています 🧡 📑 このページについて Bambda スクリプトの種類 リポジトリの内容 スクリプトを Burp にインポートする ライブラリ内のスクリプトを更新する 独自のスクリプトを投稿する リソース Bambda スクリプトの種類 Bambda は、サポートされている Burp ツールで実行されるスクリプトです。これらを使用すると、Burp Suite...

burp-exporter

Exporter Extension for Burp Suite Community and Pro Follow us to know more about tips and others extensions Description Exporter is a Burp Suite extension to copy a request to a file or the clipboard as multiple programming languages functions. It also adds a tab called Exporter where you can...

auto-repeater

Auto Repeater Burp 扩展 关于 这是由 Justin Moore（NCC Group）编写的优秀 Auto Repeater 扩展的修改版本。 原始仓库可在 https://github.com/nccgroup/AutoRepeater 找到。 Portswigger 版本可在 https://github.com/portswigger/auto-repeater 找到。 不同之处 目前，BApp 商店中的版本存在问题，截至撰写本文时，它与仓库中的代码更改尚未同步。即使从源码构建仓库，也有一个大问题：每个请求只会执行一个 Replacement，而不是全部执行。NC...

Burp-Recordadora

🧙‍♂️ Recordadora Recordadora 是一款受《哈利·波特》启发的 BurpSuite 扩展。 就像纳威的记忆球一样，它帮助你 不忘记 也不会丢失测试上下文。 ✨ 功能 保存和恢复 Proxy 历史记录 导出和导入 Repeater 的请求 持久化 Intruder 的载荷 支持 .log 文件以共享会话 集成到上下文菜单（右键 → 发送到 Recordadora） 兼容 BurpSuite Community 和 Professional 📥 安装 选项 1：使用已编译的 .jar 1. 从 Releases 下载最新版本。 2. 打开 BurpSuite →...

WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting

WordPress Panda Pods Repeater Field before 1.5.4 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. This can be leveraged against a user who has at least Contributor permission. An attacker can also steal...

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. id: CVE-2021-28937 info: name: Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure...

CVE-2025-34152

⚠️ CVE-2025-34152 – Shenzhen Aitemi M300 Wi-Fi 中继器远程代码执行（RCE） 🚨 概述 Shenzhen Aitemi M300 Wi-Fi 中继器存在一个未认证远程代码执行（RCE）漏洞。 无需登录 不会 重启设备 可远程利用 🛠 受影响版本 版本| 状态 ---|--- 1.0.x| ❌ 存在漏洞 1.1.x| ❌ 存在漏洞 1.2.x| ❌ 存在漏洞 2.0.x| ⚠️ 查看厂商更新 💡 修复建议 更新至厂商发布的最新固件 限制管理界面访问（仅限 LAN） 启用防火墙规则阻止 WAN 访问 监控日志以发现可疑请求 🧪...

burpsuiefakeip

Reproducido de https://github.com/TheKingOfDuck/burpFakeIP BurpFakeIP falsificación de IP en burpsuite, lo digo en serio. Cuatro pequeñas funciones Falsificar una IP específica Falsificar la IP local Falsificar una IP aleatoria Fuerza bruta con IP aleatoria 0x01 Falsificar una IP específica En el...

CVE-2026-51722

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51722

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68673

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-19613 ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...

EUVD-2026-59592

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-18807 ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-14230

In ECS (Ele Custom Skin) plugin for Elementor before 4.3.8, Dynamic Repeater AJAX handlers lack capability and object-ownership checks. A low-privileged Contributor can write unsanitized data-source bindings into any post, including admin pages, causing stored XSS that fires in visitor or admin s...

EUVD-2026-59588

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-73143

A flaw was found in svxlink's RtlTcp component. A malformed rtltcp greeting from a remote source triggers an unconditional exit1 call, causing the entire svxlink daemon to terminate. A remote attacker can exploit this to achieve a complete denial of service of the repeater controller. Mitigation...

CVE-2026-19348

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilterconf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command...

CVE-2026-19348

The CVE-2026-19348 entry concerns Shenzhen Aitemi M300 Wi‑Fi Repeater. A vulnerability in the sprintf handling within /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1 allows remote command injection by manipulating parameters such as enable/name/mac. Impact is h...