wholeaked

Introduction , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage...

CVE-2026-29000-Lab

CVE-2026-29000 — pac4j-jwt Library-Level PoC Lab TL;DR This repository contains a library-level PoC for CVE-2026-29000 in pac4j-jwt. It compares vulnerable and patched behavior with two cases: Baseline : a legitimate token should be accepted Attack : a forged token should be accepted on vulnerabl...

CVE-2022-1292

CVE-2022-1292 Automation to validate the impact of the vulnerability CVE-2022-1292 on a specific system. This script checks, validates and exploits the vulnerability...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

Valid8Proxy

If you find this GitHub repo useful, please consider giving it a star! ⭐️ .png Valid8Proxy is a fast and efficient tool designed for fetching, validating, and storing working proxies HTTP, HTTPS, SOCKS4, SOCKS5, and Mixed. Perfect for web scraping, OSINT, automation, or network testing. 🚀 Run...

CVE-2025-55816

CVE-2025-55816 CVE-2025-55816 HotelDruid 3.0.7 Author: partywave Collab: Raptx team External references HotelDruid 3.0.8 changelog CVE blogpost Raptx site Vulnerability The vulnerability is a simple Stored Cross Site Scripting XSS in /modificaapp.php endpoint. The attacker can insert a javascript...

blitzstrike

Blitz Strike Reconnaissance at speed. Analysis in depth. Validation before report. Blitz Strike is a structured penetration-testing methodology — reconnaissance, source analysis, and validation — delivered as a universal MCP server. It enumerates the attack surface BLITZ, traces source-to-sink...

API-Security-Checklist

繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

json-sanitizer

OWASP JSON Sanitizer Converts JSON-like text into valid JSON, with escaping for HTML script elements and XML CDATA sections. It repairs input rather than rejecting malformed JSON; use a strict parser when invalid input must be rejected. Requires Java 8 or later , with no runtime dependencies...

awesome-nodejs-security

A curated list of awesome Node.js Security resources. Learn Node.js Secure Coding techniques and best practices from Liran Tal Contents Tools Web Framework Hardening Static Code Analysis Dynamic Application Security Testing Input/Output Validation Secure Composition CSRF Vulnerabilities and...

WAFNinja

WAFNinja WAFNinja - Penetration testers favorite for WAF Bypassing WAFNinja is a CLI tool written in Python. It shall help penetration testers to bypass a WAF by automating steps necessary for bypassing input validation. The tool was created with the objective to be easily extendible, simple to u...

MemorizingTrustManager

MemorizingTrustManager - Private Cloud Support for Your App MemorizingTrustManager MTM is a project to enable smarter and more secure use of SSL on Android. If it encounters an unknown SSL certificate, it asks the user whether to accept the certificate once, permanently or to abort the connection...

Hongdian H8922 3.0.5 Devices - Local File Inclusion

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out wi...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

kkFileView 4.0 - Server-Side Request Forgery

kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests. id: CVE-2022-42149 info: name: kkFileView 4.0 - Server-Side Request Forge...

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

Aryanic HighMail (High CMS) - Cross-Site Scripting

A cross-site scripting vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. id: CVE-2020-23517 info: name: Aryanic HighMail High CMS - Cross-Site Scripting author: geeknik severity: medium...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...