mkpath

mkpath URL-Pfadkombinationen mit einer Wordlist erstellen Lies eine Wordlist-Datei und generiere Pfadkombinationen für eine bestimmte Domain oder eine Liste von Domains. Die Eingabe aus der Wordlist-Datei wird in Kleinbuchstaben umgewandelt und eindeutige Wörter werden verarbeitet. Zusätzlich kan...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

unfurl

unfurl Estrai le parti degli URL forniti su stdin Installazione Se hai Go installato e configurato: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest Altrimenti scarica l'ultimo binario per la tua piattaforma, estrailo e spostalo da qualche parte nel tuo $PATH es. /usr/bin/:...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

SSRF-Testing

Ich bin dankbar für die Unterstützung von Tuta SSRF Server Side Request Forgery Testressourcen Schnelle URL-basierte Bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

OSV-2026-1189 Global-buffer-overflow in oidc_cfg_redirect_urls_allowed_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=550474749 Crash type: Global-buffer-overflow READ 8 Crash state: oidccfgredirecturlsallowedget oidcvalidateredirecturl fuzzurl.c...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

CVE-2025-32140

🚨 CVE-2025-32140 – Exploit WP Remote Thumbnail Caricamento Arbitrario di File 📝 Descrizione CVE-2025-32140 è una vulnerabilità critica nel plugin WP Remote Thumbnail per WordPress. Consente a attaccanti autenticati con permessi di collaboratore o superiori di caricare file arbitrari , come web...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...

starlette-host-header-lab

Starlette Host-Header URL Confusion Lab X41-2026-002 Un laboratorio formativo containerizzato e autonomo che riproduce la vulnerabilità di bypass dell'autenticazione in Starlette, divulgata da X41 D-Sec. Advisory: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Conflitto di interpretazione /...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, rendering the security check permanently inert. An attacker with low privileges can pass file:// URLs to nltk.data.load() to read arbitrary...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-59809

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...