CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Works On VMware-VCSA-all-6.7.0-8217866、VMware-VIM-all-6.7.0-8217866 ✔ VMware-VCSA-all-6.5.0-16613358 ✔ For vCenter6.7 U2+ vCenter 6.7U2+ running website in memory,so this exp can't work for 6.7 u2+. Need test vCenter 6.5 LinuxVCSA/WindowWaiting For Test vCenter 6.7...

miasma

🌀 Miasma AI companies continually scrape the internet at an enormous scale, swallowing up all of its contents to use as training data for their next models. If you have a public website, they are already stealing your work. Miasma is here to help you fight back! Spin up the server and point any...

noapi-google-search-mcp

noapi-google-search-mcp [email protected] If you want to support noapi-google-mcp or gpt-oss-20B/120B-Vision and other open source models in the pipeline please add to my GPU compute fund: around $3000 are needed. If you find this useful, consider supporting continued development and new...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

pritunl

pritunl: servidor VPN empresarial Pritunl es un servidor VPN empresarial distribuido construido con el protocolo OpenVPN. La documentación y más información se pueden encontrar en la página principal pritunl.com Instalación desde el código fuente Install MongoDB if running single host configurati...

CVE-2026-103059

The Gitea built-in SSH server is vulnerable to an authentication bypass when START_SSH_SERVER is set to true. The root cause is the use of an SQL LIKE comparison to look up public keys, which performs case-insensitive matching on certain databases like SQLite . An attacker could exploit this by c...

notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

zeek-asyncrat-detector

Un detector de malware AsyncRAT basado en Zeek El malware a menudo oculta las comunicaciones con su servidor de comando y control C2 a través de HTTPS. El cifrado en HTTPS normalmente oculta el compromiso el tiempo suficiente para que el malware logre su objetivo. Esto hace que la detección de...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-96890

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

tplmap

Tplmap 本项目已不再维护。只要不破坏测试套件，我会合并新的PR。 Tplmap 协助利用代码注入和服务器端模板注入漏洞，借助多种沙箱逃逸技术，获取底层操作系统的访问权限。 该工具及其测试套件旨在研究 SSTI 漏洞类别，并作为 Web 应用程序渗透测试中的进攻性安全工具使用。 沙箱逃逸技术源自 James Kett 的服务器端模板注入：现代 Web 应用的 RCE、其他公开研究 1 2，以及本工具的原創贡献3 4。 它可以利用多种代码上下文和盲注入场景。它还支持 Python、Ruby、PHP、Java 中的类似 eval 的代码注入以及通用的非沙箱模板引擎。 服务器端模板注入...

CVE-2026-105488

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries...

CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-103620

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.com Run using per...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 完整文档 - https://github.com/sullo/nikto/wiki 正常运行： git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.com Run using perl if you forget to chm...

CVE-2022-1388-Exploit

CVE-2022-1388-Exploit 用于 CVE-2022-1388 F5 Big-IP 的测试与利用脚本 masscheck.py 将接收一个文件输入，在不实际利用漏洞的情况下检查主机是否存在漏洞。 检测： 扫描 /mgmt/tm/util/bash 作为端点，该端点可能出现在 Web 服务器日志中。或者，如果您有 F5 设备，请尽快打补丁，受影响版本如下所示，补丁可从 https://support.f5.com/csp/article/K23605346 获取。 受影响版本 BIG-IP 16.1.0 至 16.1.2（已发布补丁） BIG-IP 15.1.0 至...

CVE-2023-27163

CVE-2023-27163 - SSRF en Request Baskets Prueba de concepto de SSRF en Request Baskets texto alternativo Las versiones de Request Baskets anteriores a la 1.2.1 son vulnerables a ataques de Server Side Request Forgery SSRF a través del componente /api/baskets/name. uso git clone...