CVE-2026-88785

The Simple Membership WordPress plugin, in versions before 4.8.3 , is vulnerable to credential exposure. When the optional auto-login-after-registration feature is enabled, the plugin transmits a newly registered member's plaintext password within a URL query string . This exposure allows anyone ...

EUVD-2026-96773

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

onioff

██████╗ ███╗ ██╗██╗ ██████╗ ███████╗███████╗ ██╔═══██╗████╗ ██║██║██╔═══██╗██╔════╝██╔════╝ ██║ ██║██╔██╗ ██║██║██║ ██║█████╗ █████╗ ██║ ██║██║╚██╗██║██║██║ ██║██╔══╝ ██╔══╝ ╚██████╔╝██║ ╚████║██║╚██████╔╝██║ ██║ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═════╝ ╚═╝ ╚═╝ v2.0 Una herramienta simple - escrita en Python...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome DevTools. Recursos...

bypass-url-parser

Bypass Url Parser Herramienta que prueba MUCHAS derivaciones bypasses de URL para alcanzar una página protegida 40X. Si te preguntas por qué este código es nada más que un envoltorio sucio de curl, aquí está el motivo: La mayoría de las requests de Python realizan codificación/descodificación de...

struts-pwn

struts-pwn Un exploit para Apache Struts CVE-2017-5638 Uso Probando una sola URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Probando una lista de URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Comprobando si la vulnerabilidad existe en una sola UR...

qsreplace

qsreplace Acepta URLs desde stdin, reemplaza todos los valores de la cadena de consulta con un valor proporcionado por el usuario, solo genera cada combinación de parámetros de cadena de consulta una vez por host y ruta. Uso Archivo de entrada de ejemplo: ▶ cat urls.txt...

CVE-2026-108706

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

PT-2026-110122

Name of the Vulnerable Software and Affected Versions LLMGateway versions prior to 1.20.1 Description A blind server-side request forgery SSRF exists in the video-generation callback url extension. This issue allows API key holders to send Webhook POST requests to internal hosts, including...

PT-2026-110132

Name of the Vulnerable Software and Affected Versions Corteza versions prior to 2024.9.11 Description An incorrect authorization issue exists in the compose attachment endpoints. Unauthenticated attackers can download private attachments by modifying the URL kind segment to page, icon, or...

PT-2026-110138

Name of the Vulnerable Software and Affected Versions Miniflux versions 2.3.0 through 2.3.3 Description Authenticated users can perform a server-side request forgery SSRF, which is a flaw that allows a server to be coerced into making requests to an unintended location. By configuring the proxy u...

PT-2026-110047

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

CVE-2026-108770: Server-Side Request Forgery (SSRF)

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

PT-2026-110003

Name of the Vulnerable Software and Affected Versions Studio-Saelix Sencho versions prior to 0.94.1 Description A remote server-side request forgery SSRF exists within the git-sources Browse API Endpoint, specifically affecting the outboundTarget.ts file. This issue occurs when the repo url...

Linux Distros Unpatched Vulnerability : CVE-2026-41691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

unfurl

unfurl Extrahiere Teile von URLs, die über stdin bereitgestellt werden Installation Wenn Go installiert und konfiguriert ist: ▶ go install github.com/tomnomnom/unfurl@latest Andernfalls lade die neueste Binärdatei für deine Plattform herunter, entpacke sie und verschiebe sie an einen Ort in deine...

maskphish

👨‍💻️ Autore : jaykali 🔥 MaskPhish MaskPhish non è uno strumento di phishing. È solo una prova di concetto della "Tecnologia di Creazione di URL". È un semplice script Bash per nascondere un URL di phishing sotto un URL dall'aspetto normale google.com o facebook.com. Può essere integrato in...