CVE-2025-70828

CVE-2025-70828 Riepilogo È stata scoperta una vulnerabilità di lettura arbitraria dei file in Datart v1.0.0-rc.3. L'applicazione non valida correttamente l'URL di connessione JDBC durante la configurazione dell'origine dati. Dettagli della vulnerabilità Tipo di vulnerabilità: Validazione impropri...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / lokales Dateilesen über Antwort-URL CVE-2026-13233 Nicht vertrauenswürdiger Upstream: der Provider, der die URL abgerufen hat, die seine Antwort ihm vorgab. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status:...

livewire-vuln-scanner

Scanner Passivo di Vulnerabilità Livewire Livewire Passive Vulnerability Scanner è uno strumento Python 2.7 progettato per rilevare passivamente le versioni di Livewire utilizzate dai siti web e identificare potenziali vulnerabilità basate sul confronto delle versioni. Questo scanner non sfrutta...

CVE-2025-55182-exploit

CVE-2025-55182-exploit TL;DR Questo strumento è solo per test di penetrazione legali. Non intraprendere attività illegali. Come usare python3 exploit.py Video dimostrativo...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

Grafana OSS: Stored XSS via external Alertmanager generatorURL

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user’s Grafana session. Grafana renders...

uddup

UDdup - URLs Deduplication Tool The tool gets a list of URLs, and removes "duplicate" pages in the sense of URL patterns that are probably repetitive and points to the same web template. For example: root@kitploit: https://www.example.com/product/123 https://www.example.com/product/456...

uddup

UDdup - Strumento di deduplicazione degli URL Lo strumento riceve un elenco di URL e rimuove le pagine "duplicate" nel senso di pattern URL probabilmente ripetitivi che puntano allo stesso template web. Ad esempio: root@kitploit: https://www.example.com/product/123...

crlfuzz

CRLFuzz A fast tool to scan CRLF vulnerability written in Go Resources Installation from Binary from Source from GitHub Usage Basic Usage Flags Target Single URL URLs from list from Stdin...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Dinu11secur1ty — Un toolkit modulare che trasforma le catture di Burp in azioni istantanee e ripetibili. Converti. Riutilizza. Apri. Automatizza. 🚀 Presentazione rapida BurpSuite-Grand-Master-Tools è un toolkit leggero, verificabile ed estensibile per pentester e...

mkpath

mkpath URL-Pfadkombinationen mit einer Wordlist erstellen Lies eine Wordlist-Datei und generiere Pfadkombinationen für eine bestimmte Domain oder eine Liste von Domains. Die Eingabe aus der Wordlist-Datei wird in Kleinbuchstaben umgewandelt und eindeutige Wörter werden verarbeitet. Zusätzlich kan...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

unfurl

unfurl Estrai le parti degli URL forniti su stdin Installazione Se hai Go installato e configurato: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest Altrimenti scarica l'ultimo binario per la tua piattaforma, estrailo e spostalo da qualche parte nel tuo $PATH es. /usr/bin/:...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

SSRF-Testing

Ich bin dankbar für die Unterstützung von Tuta SSRF Server Side Request Forgery Testressourcen Schnelle URL-basierte Bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...