xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

urlcrazy

😜⌨ URLCrazy URLCrazy is an OSINT tool to generate and test domain typos or variations to detect or perform typo squatting, URL hijacking, phishing, and corporate espionage. Homepage: https://github.com/urbanadventurer/urlcrazy 🌟 Use Cases Detect typo squatters profiting from typos on your domain...

CVE-2026-71518

CVE-2026-71518 — Typemill Unauthenticated Authorization Bypass Path-equivalent URL variants bypass role-restricted media downloads Restriction is keyed on the raw request path; the file is read from the OS-resolved path — the two disagree At a glance · Summary · Root cause · Attack chain · Exploi...

MyLog4Shell

MyLog4Shell log4j RCE Exploitation Detection You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228 Grep / Zgrep This command searches for exploitation attempts in uncompressed files in folder /var/log - '/usr/var/log' and all sub...

CVE-2026-64633

CVE-2026-64633 Analysis Payloads Files payloads/ — generated payload documents treatment + control variants payloads/manifest.json — payload manifest with pids / pairs...

CVE-2026-113612

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

EUVD-2026-105090

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612

The SparkyFitness application (versions prior to 0.17.0 ) contains a missing authorization vulnerability (CWE-862) within the DELETE /api/foods/food-variants/:id endpoint. This flaw allows authenticated users to delete serving and nutrition variants belonging to other users. Attackers can identif...

PT-2026-118472

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CodeWithCJ SparkyFitness Authorization Issue Vulnerability

Versions of CodeWithCJ SparkyFitness prior to 0.17.0 have a vulnerability related to authorization. This vulnerability arises from a lack of authorization checks. Authorized attackers can use the DELETE /api/foods/food-variants/:id endpoint to delete food variants for other users. They can also u...

Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability

Apostrophe Technologies' ApostropheCMS has an authorization issue vulnerability. This vulnerability stems from improper authorization checks, allowing editors with import privileges but without publishing privileges to create, replace, or delete published variants by importing auxiliary programs,...

CVE-2026-103518

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-102611

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-103518: Improper Neutralization of Special Elements used in an SQL Command

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants. ' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-115400

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress FluentCart: A New Era of eCommerce SQL Injection Vulnerabilities

WordPress FluentCart – A New Era of eCommerce. Versions 1.7.0 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter ‘products.variants.’ and inadequate SQL query preparation. This could allow authenticated attackers to append addition...

ditto

Ditto es una pequeña herramienta que acepta un nombre de dominio como entrada y genera todas sus variantes para un ataque homográfico como salida, verificando cuáles están disponibles y cuáles ya están registrados. Dominios PoC https://tᴡitter.com/ https://clᴏudflare.com Usando con Docker La imag...