Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

SUSE Rancher - Stored XSS via Unauthenticated Settings Override

SUSE Rancher supports HTTP method override via the method query parameter in the Norman API framework. Public UI settings routes were intended to be read-only for unauthenticated users, but the method override allows an unauthenticated attacker to perform PUT requests, modifying settings such as...

Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure

Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator. id: CVE-2026-42221 info: name:...

Nginx UI < 2.3.3 - Information Disclosure

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...

VMware NSX SD-WAN Edge - Command Injection

VMware NSX SD-WAN Edge formerly VeloCloud Edge before 3.1.2 contains an unauthenticated command injection in the local web UI diagnostic tools Ping/Traceroute. This template detects it reliably by injecting 'id', 'whoami', and a random marker. id: CVE-2018-6961 info: name: VMware NSX SD-WAN Edge ...

Mailcow Dockerized Swagger UI - Cross-Site Scripting

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI before 4.11.1 that is affected by a DOM-based Cross-Site Scripting XSS vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

Fastify Swagger-UI - Information Disclosure

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

xpfarm

XPFarm An open-source AI-augmented offensive security platform that wraps well-known security tools behind a unified web UI — with distributed scanning, AI-generated reports, a smart scan planner, an interactive attack graph, and a community Plugin SDK. Also check out ObsidianBox Modern on Google...

de4py

de4py ⚠️ de4py is FREE & OPEN SOURCE CC BY-NC 4.0. Any paid versions sold elsewhere or commercial use are NOT permitted. If you paid for de4py, you were misled. De4py is an advanced Python deobfuscator with a beautiful UI PySide6 and a robust set of features for malware analysts and reverse...

Mythic

Mythic A cross-platform, post-exploit, red teaming framework built with GoLang, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming. Check out a series of YouTube videos...

renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

Veto

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

jaeles

!IMPORTANT This repository has been archived and is no longer maintained. Check out github.com/vigolium/vigolium — a brand new scanner that I made that's better in every way. Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner...

faraday

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

L0p4Map

L0p4Map Nmap was blind. L0p4Map sees. Professional network monitoring & visualization tool built for security researchers. https://github.com/user-attachments/assets/745eb888-0636-47e8-9293-38a706a8e897 What is L0p4Map? L0p4Map is a professional grade network monitoring tool that combines the pow...