WordPress Stop Spammers <2021.9 - Cross-Site Scripting

WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests such as matching a spam word, thus outputting it in an attribute after sanitizing it to remove HTML tags. id: CVE-2021-24245 info: name:...

Sercomm VD625 Smart Modems - CRLF Injection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. id: CVE-2021-27132 info: name: Sercomm VD625 Smart Modems - CRLF Injection author: geeknik severity: critical description: Sercomm...

CodiMD <2.5.4 - Insecure Filename Randomization

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an...

AffiliateImporterEb <= 1.0.6 - Reflected XSS

AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

WordPress Job Portal < 2.0.6 - SQL Injection

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape the city parameter before using it in a SQL statement,leading to a SQL injection vulnerability that is exploitable by unauthenticated users. This vulnerability can be used to extractsensitive data from the database or...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE

Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP. id: CVE-2026-35273 info: name: Oracle PeopleSoft PeopleTool...

airgeddon

airgeddon This is a multi-use bash script for Linux systems to audit wireless networks. All the needed info about how to "install | use | enjoy" airgeddon is present at GitHub's Wiki. I. Content & Features Home Features Screenshots Wallpapers II. Requirements Requirements Compatibility Cards and...

CVE-2022-3368

CVE-2022-3368 针对Avira Security软件更新组件中任意文件移动漏洞的概念验证（PoC）。 用户可选择使用此功能更新PC上任何过时的软件，当使用此功能时，Avira Security服务会将下载的文件放置在 c:\ProgramData\Avira\Security\Temp 目录下。首先在子目录中创建的文件格式为 ，随后此文件会被移动到仅...

flipperzero-firmware

Flipper Zero 固件 Flipper Zero 官方网站 - 向朋友介绍 Flipper Zero 功能的最简单方式。 Flipper Zero 固件更新 - 让你的海豚更强大：最新固件版本、PC 和移动设备升级工具。 用户文档 - 了解更多关于你的海豚：规格、使用指南，以及你想问的任何问题。 开发者文档 - 深入探索 Flipper Zero 固件源代码：构建系统、固件结构等。 贡献 我们的主要目标是围绕 Flipper 建立一个健康、可持续的社区，因此我们欢迎任何新想法和贡献。不过这里也有一定的规则和禁忌，请仔细阅读本页和我们的行为准则。 我需要帮助...

linux-soft-exploit-suggester

linux-soft-exploit-suggester Script to find exploits for all vulnerable software on the system, targeting software packages rather than just kernel vulnerabilities. It uses the exploit database to assess the security of packages and search for exploits to help with privilege escalation. Usage...

EUVD-2025-26599

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not...

KaliPackergeManager

KaliPackergeManager kalipm.sh 是一款针对 Kali Linux 的强大软件包管理工具，它提供用户友好的菜单界面，简化了各类软件包和工具的安装过程。它优化了软件管理流程，使用户能够轻松安装不同类别的软件包。 功能特点 交互式菜单：享受直观且用户友好的菜单界面，轻松选择软件包。 分类软件包：在多个类别中浏览软件包，包括系统、桌面、工具、菜单和其他。 高效安装：借助 apt-get 包管理器自动安装所选软件包。 系统更新：通过集成的更新功能保持系统最新。 安装 要安装 KaliPm，只需从 GitHub 克隆仓库： root@kitploit: git clone...

heimdall_webserver

ATTENTION, this project is on a beta version, there's a lot of bugs and problem, if you want to help the project use this on a lab not in yout real environment. NO, there's not https implemented yet, it will come on the next upgrade Heimdall It's a tool to manage vulnerables packages in your nix...

CVE-2026-0023-Update-Ownership-PoC

CVE-2026-0023 - Android 更新所有权信任绕过 PoC 一个完整的 Android 实验室环境，用于重现和研究 CVE-2026-0023。 此仓库演示了 CVE-2026-0023 如何允许普通安装程序影响仅应由系统控制的内部 Android 安装标志，从而导致应用程序更新期间 Android 的“更新所有权”警告被抑制。 该项目包含三个 Android 应用程序，它们模拟了一个真实的更新所有权工作流程，并提供了一个可重现的环境来观察有漏洞的行为。 概述 Android 引入了更新所有权，以帮助应用程序、应用商店和企业环境维护可信的更新链。...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

covert-tube

covert-tube A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption...

toolkit

English | Español Indetectables Toolkit Designed as a Swiss Army knife, this curated toolkit is invaluable for malware analysts, crackers, and cybersecurity experts. It is meticulously crafted to support both novice and experienced users. This toolkit complements the manuals and the numbered...